# Can the wrapping token be scoped to cidr?

**URL:** <https://discuss.hashicorp.com/t/can-the-wrapping-token-be-scoped-to-cidr/3290>\
**Category:** Vault\
**Created:** [October 10, 2019, 5:42pm UTC](https://discuss.hashicorp.com/t/can-the-wrapping-token-be-scoped-to-cidr/3290 "2019-10-10T17:42:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ixe013](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ixe013/32/2605_2.png) [@ixe013](https://discuss.hashicorp.com/u/ixe013)\
**Post date:** [October 10, 2019, 5:42pm UTC](https://discuss.hashicorp.com/t/can-the-wrapping-token-be-scoped-to-cidr/3290/1 "2019-10-10T17:42:13Z")

</div>

I have a pki mount. I can issue certificates from it with this command:

```auto
vault write pki/issue/issuerRole common_name=test1.example.com

```

But I don’t want the script that issues that command to see the private key, so I wrap it by adding `-wrap-ttl 60m` to the command:

```auto
vault write -wrap-ttl 60m pki/issue/issuerRole common_name=test1.example.com

```

I get back something like this:

```auto
Key Value
--- -----
wrapping_token: s.bKA6FFKYqLY6S5BlcmPSKUAy
wrapping_accessor: gRCRbs8EKcypPrg7y2nCZzgF
wrapping_token_ttl: 1h
wrapping_token_creation_time: 2019-10-10 13:09:47.1881939 -0400 EDT
wrapping_token_creation_path: pki/issue/issuerRole

```

As expected, I can retreive the certificate and private key by calling:

```auto
vault unwrap s.bKA6FFKYqLY6S5BlcmPSKUAy

```

How can I **put restrictions like source IP or subnet on the unwrapping token** (other than duration and num uses) ?

---

<div class="post-metadata">

**Author:** ![ncabatoff](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ncabatoff/32/818_2.png) [@ncabatoff](https://discuss.hashicorp.com/u/ncabatoff)\
**Post date:** [October 14, 2019, 1:46pm UTC](https://discuss.hashicorp.com/t/can-the-wrapping-token-be-scoped-to-cidr/3290/2 "2019-10-14T13:46:12Z")

</div>

Hi Guillaume,

There is nothing I can think of builtin to Vault that would let you do that.