# Token help - how to create and manage **URL:** \ **Category:** Vault\ **Created:** [March 3, 2021, 3:30pm UTC](https://discuss.hashicorp.com/t/token-help-how-to-create-and-manage/21634 "2021-03-03T15:30:15Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![farslayer9](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/farslayer9/32/17644_2.png) [@farslayer9](https://discuss.hashicorp.com/u/farslayer9)\ **Post date:** [March 3, 2021, 3:30pm UTC](https://discuss.hashicorp.com/t/token-help-how-to-create-and-manage/21634/1 "2021-03-03T15:30:15Z")
I need help with tokens, and I’m a noob I guess. I"ve installed a non-dev vault, gotten my root token, vault is unseals and I’ve enabled the approle auth. Now I don’t understand how to interact with this auth method, esp. over the API. TO do anything via the API requires a token, but I’m supposed to disable the root token. How do I get a token to use in the API calls? HOw do I get a token for other API calls, such as to create a policy? I need serious help here, I Know I"m just missing something simple. THanks, Richard ---
**Author:** ![stuart-c](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/stuart-c/32/10789_2.png) [@stuart-c](https://discuss.hashicorp.com/u/stuart-c)\ **Post date:** [March 4, 2021, 12:41pm UTC](https://discuss.hashicorp.com/t/token-help-how-to-create-and-manage/21634/2 "2021-03-04T12:41:42Z")
You only need a token to interact with secrets or configuration APIs. You don’t need a token to login (for example using AppRole). So the normal process would be: 1. Initialise Vault and obtain unseal/recovery key(s) and initial root token 2. Use root token for initial config, including setup of other auth methods 3. Revoke root token 4. Use Vault - login using AppRole, Kubernetes, AWs, etc. 5. If further config is needed (which needs a root token) generate using unseal/recovery keys, make config changes and then revoke again.