# How to prevent token being stole

**URL:** <https://discuss.hashicorp.com/t/how-to-prevent-token-being-stole/13060>\
**Category:** Vault\
**Created:** [August 19, 2020, 4:48pm UTC](https://discuss.hashicorp.com/t/how-to-prevent-token-being-stole/13060 "2020-08-19T16:48:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shanerbo](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/shanerbo/32/10726_2.png) [@shanerbo](https://discuss.hashicorp.com/u/shanerbo)\
**Post date:** [August 19, 2020, 4:48pm UTC](https://discuss.hashicorp.com/t/how-to-prevent-token-being-stole/13060/1 "2020-08-19T16:48:15Z")

</div>

Does it mean, if the token or username and password are stolen, anyone can use that token(userpass) to access the vault server? if that is the case, how do i secure a token(userpass) from being stolen?

---

<div class="post-metadata">

**Author:** ![Wolfsrudel](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/wolfsrudel/32/28465_2.png) [@Wolfsrudel](https://discuss.hashicorp.com/u/Wolfsrudel)\
**Post date:** [August 19, 2020, 5:01pm UTC](https://discuss.hashicorp.com/t/how-to-prevent-token-being-stole/13060/2 "2020-08-19T17:01:09Z")

</div>

First of all read the production hardening guide:

> **[Production Hardening | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/vault/production-hardening)**
>
> This guide provides guidance on best practices for a production hardened deployment of HashiCorp Vault.

At the end you can create an admin/ root like policy ([https://learn.hashicorp.com/tutorials/vault/policies#example-policy-for-admin](https://learn.hashicorp.com/tutorials/vault/policies#example-policy-for-admin)) and let vault rotate the root token so that even you won’t have it.

---

<div class="post-metadata">

**Author:** ![shanerbo](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/shanerbo/32/10726_2.png) [@shanerbo](https://discuss.hashicorp.com/u/shanerbo)\
**Post date:** [August 19, 2020, 5:32pm UTC](https://discuss.hashicorp.com/t/how-to-prevent-token-being-stole/13060/3 "2020-08-19T17:32:07Z")

</div>

Hi Wolfsrudel,

Thank you for your reply, let’s say I use curl to access secret

```auto
curl \
    --header "X-Vault-Token: $VAULT_TOKEN" \
    --request POST \
    --data '{ "data": {"password": "my-long-password"} }' \
    http://127.0.0.1:8200/v1/secret/data/creds | jq -r ".data"

```

If $VAULT\_TOKEN is stolen, anyone can use this token to retrieve secret from vault, is that correct?  
I am using vault agent to access secret in vault secret. What will be the best practise to secure accessing the data

---

<div class="post-metadata">

**Author:** ![Wolfsrudel](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/wolfsrudel/32/28465_2.png) [@Wolfsrudel](https://discuss.hashicorp.com/u/Wolfsrudel)\
**Post date:** [August 19, 2020, 5:38pm UTC](https://discuss.hashicorp.com/t/how-to-prevent-token-being-stole/13060/4 "2020-08-19T17:38:06Z")

</div>

Yes, that’s true. The root token is the God like access to Vault. 😉

You should follow the principle of least privilege:

> Definition of the **Principle of Least Privilege** (POLP)  
> The **principle of least privilege** is the idea that at any user, program, or process should have only the bare **minimum privileges** necessary to perform its function.

> **[What is the Principle of Least Privilege (POLP)?](https://www.digitalguardian.com/blog/what-principle-least-privilege-polp-best-practice-information-security-and-compliance)**
>
> Learn about the benefits of implementing the principle of least privilege in Data Protection 101, our series on the fundamentals of information security.