# Why would the trusted entity need to wrapp the secret id in approle authentication?

**URL:** <https://discuss.hashicorp.com/t/why-would-the-trusted-entity-need-to-wrapp-the-secret-id-in-approle-authentication/45784>\
**Category:** Vault\
**Created:** [October 19, 2022, 9:23am UTC](https://discuss.hashicorp.com/t/why-would-the-trusted-entity-need-to-wrapp-the-secret-id-in-approle-authentication/45784 "2022-10-19T09:23:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![masuberu](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/masuberu/32/23944_2.png) [@masuberu](https://discuss.hashicorp.com/u/masuberu)\
**Post date:** [October 19, 2022, 9:23am UTC](https://discuss.hashicorp.com/t/why-would-the-trusted-entity-need-to-wrapp-the-secret-id-in-approle-authentication/45784/1 "2022-10-19T09:23:00Z")

</div>

Hi,

I am learning about vault and approles, I have been reading this tutorial [AppRole Pull Authentication | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/vault/approle) and I don’t understand the reason the trusted entity wraps the token

```auto
vault write -wrap-ttl=60s -force auth/approle/role/jenkins/secret-id

```

The reason I ask is that the documentation also says we can restrict the token\_ttl in the role so aren’t `-wrappt-ttl` and `token_ttl` trying to solve the same problem? why do we need to use both?

thank you very much