Hand a job one secret, and nothing else.
An automated job needs one API key. It should not get the root token, and it should not see anything else. This page builds that with uBixVault: a policy, a scoped token, and a clean revoke.
policy secret/data/app -> read token policies=[app-ro] -> given to the job job GET /v1/secret/data/app -> 200 POST /v1/secret/data/app -> 403
uBixVault is default-deny: a token can do only what its policies grant. A job that reads one secret therefore gets a policy with one path and one capability, and a token carrying only that policy.
A token created by a caller that is not root and holds no sudo is that caller's child: it is revoked when its parent is revoked or expires (v1.5). Tokens issued by root are not tied to the operator's own token.
1. Start a dev server. Plain HTTP and an audit log; for anything real, pass -tls-cert and -tls-key.
$ go build -o bin/ubixvault ./cmd/ubixvault $ ./bin/ubixvault server -data ./data -audit-log ./audit.log
2. Initialize and unseal. Three shares, any two unseal. Save the keys and the root token; they are shown once.
$ export UBIXVAULT_ADDR=http://127.0.0.1:8200 $ ubixvault operator init -shares 3 -threshold 2 $ ubixvault operator unseal <key-0> $ ubixvault operator unseal <key-1> $ ubixvault operator seal-status
3. Store the secret.
$ export VAULT=$UBIXVAULT_ADDR $ export T="X-Vault-Token: <root_token>" $ curl -s -H "$T" -X POST $VAULT/v1/secret/data/app \ -d '{"data":{"api_key":"sk-123"}}'
4. Write the policy and mint the token.
$ curl -s -H "$T" -X PUT $VAULT/v1/sys/policies/acl/app-ro \ -d '{"path":{"secret/data/app":{"capabilities":["read"]}}}' $ curl -s -H "$T" -X POST $VAULT/v1/auth/token/create \ -d '{"policies":["app-ro"]}' -> {"auth":{"client_token":"uv...."}}
5. Check what the job can and cannot do.
$ J="X-Vault-Token: <client_token>" $ curl -s -o /dev/null -w '%{http_code}\n' -H "$J" $VAULT/v1/secret/data/app 200 $ curl -s -o /dev/null -w '%{http_code}\n' -H "$J" -X POST $VAULT/v1/secret/data/app \ -d '{"data":{"api_key":"x"}}' 403
6. Revoke when the job is done. A token can revoke itself.
$ curl -s -H "$J" -X POST $VAULT/v1/auth/token/revoke-self uBixVault has not yet had an independent security audit; weigh that before placing high-blast-radius secrets in it. Auth methods that fit unattended jobs (AppRole, Kubernetes ServiceAccount, JWT/OIDC) are listed on the uBixVault page, and each can set its own token_max_ttl so a login can never outlive the ceiling you chose.
The commands above, as a script you can run, are in ubixsys-manual-examples under examples/ubixvault/.
Written against uBixVault v1.5.0.