---
name: secrets-manager-setting-up-vault-dedicated-instance
title: Setting up your Vault Dedicated instance
description: In this tutorial, you learn how to set up a `Vault Dedicated` plan instance of IBM Cloud® Secrets Manager by provisioning the instance, retrieving its endpoints, generating an admin token, and signing in to the Vault UI for initial configuration.
last-updated: 2026-09-01
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/secrets-manager?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

{:codeblock: .codeblock}
{:screen: .screen}
{:download: .download}
{:external: target="_blank" .external}
{:faq: data-hd-content-type='faq'}
{:gif: data-image-type='gif'}
{:important: .important}
{:note: .note}
{:pre: .pre}
{:tip: .tip}
{:preview: .preview}
{:deprecated: .deprecated}
{:beta: .beta}
{:term: .term}
{:shortdesc: .shortdesc}
{:script: data-hd-video='script'}
{:support: data-reuse='support'}
{:table: .aria-labeledby="caption"}
{:troubleshoot: data-hd-content-type='troubleshoot'}
{:help: data-hd-content-type='help'}
{:tsCauses: .tsCauses}
{:tsResolve: .tsResolve}
{:tsSymptoms: .tsSymptoms}
{:video: .video}
{:step: data-tutorial-type='step'}
{:tutorial: data-hd-content-type='tutorial'}
{:api: .ph data-hd-interface='api'}
{:cli: .ph data-hd-interface='cli'}
{:ui: .ph data-hd-interface='ui'}
{:terraform: .ph data-hd-interface="terraform"}
{:curl: .ph data-hd-programlang='curl'}
{:java: .ph data-hd-programlang='java'}
{:ruby: .ph data-hd-programlang='ruby'}
{:c#: .ph data-hd-programlang='c#'}
{:objectc: .ph data-hd-programlang='Objective C'}
{:python: .ph data-hd-programlang='python'}
{:javascript: .ph data-hd-programlang='javascript'}
{:php: .ph data-hd-programlang='PHP'}
{:swift: .ph data-hd-programlang='swift'}
{:curl: .ph data-hd-programlang='curl'}
{:dotnet-standard: .ph data-hd-programlang='dotnet-standard'}
{:go: .ph data-hd-programlang='go'}
{:unity: .ph data-hd-programlang='unity'}
{:release-note: data-hd-content-type='release-note'}


# Setting up your Vault Dedicated instance
{: #setting-up-vault-dedicated-instance}
{: toc-content-type="tutorial"}
{: toc-services="secrets-manager"}
{: toc-completion-time="10m"}

In this tutorial, you learn how to set up a `Vault Dedicated` plan instance of IBM Cloud® Secrets Manager by provisioning the instance, retrieving its endpoints, generating an admin token, and signing in to the Vault UI for initial configuration.
{: shortdesc}

The `Vault Dedicated` plan delivers Vault Enterprise as a managed service in IBM Cloud. After your instance is provisioned, you can use the instance dashboard to find connection details and open the Vault UI to begin configuring your Vault environment.

The Vault Dedicated plan is currently available as a public beta. Beta features are provided for evaluation and testing purposes and have limitations compared to generally available features.
{: beta}

## Vault Dedicated public beta limitations
{: #setting-up-vault-dedicated-beta-limitations}

During the public beta period, the [Vault Dedicated]{: tag-green} plan has the following temporary restrictions:

- **Instance limit**: Only 1 Vault Dedicated instance per account during beta.
- **No upgrade path**: Cannot upgrade from beta to GA. All beta instances will be deleted before general availability.
- **Regional availability**: Available in Dallas and Frankfurt.
- **Free during beta**: No charges apply during the beta period.
- **Beta to GA migration**: Data migration from beta instances to GA instances is not supported.

These limitations are temporary and apply only during the public beta period. It will be removed or modified when the [Vault Dedicated]{: tag-green} plan reaches general availability.
{: important}

## Before you begin
{: #setting-up-vault-dedicated-prereqs}

Before you begin, make sure that you have an IBM Cloud account and the required IAM access to work with the service.

You need the following roles:
- The [**Manager** service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam&format=markdown) to provision an instance and generate an admin token.
- The [**Writer**, **Reader**, or **Viewer** service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam&format=markdown) to view instance details.

## Provision a Vault Dedicated plan instance
{: #setting-up-vault-dedicated-provision}
{: step}

Create a `Vault Dedicated` plan instance from the IBM Cloud catalog.

1. In the IBM Cloud console, go to the **Catalog**.
2. Select **Secrets Manager**.
3. Choose the **Vault Dedicated** plan.
4. Configure the instance:
   - Select a deployment region.
   - Enter a unique instance name.
   - Select a resource group.
   - Choose either service-managed encryption or customer-managed encryption by using Key Protect.
   - Select private-only endpoints, or enable a public endpoint if required.

   If you select **private-only** endpoints, note the following requirements before you try to connect:
   - **API access**: You must create a VPE (Virtual Private Endpoint) gateway that targets your Vault Dedicated instance. Cloud Service Endpoints (CSE) are not supported for this plan. See [Using service endpoints to privately connect to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection&format=markdown).
   - **Vault UI access**: You must use a Client-to-Site VPN that routes traffic through the VPE. The private Vault UI URL is not reachable from a browser outside the IBM Cloud private network without a VPN. See [Using Client-to-Site VPN to privately connect to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vpn-connection&format=markdown).
   {: important}

   If you plan to use both `Standard` and `Vault Dedicated` plan instances, adopt a naming convention that makes the instance type easy to identify, such as including `-standard` or `-vault dedicated` in the instance name.
   {: tip}

5. Click **Create**.

Provisioning typically completes within a few minutes, but it can take up to 15 minutes.
{: note}

For more information about provisioning an instance, see [Creating an instance](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&format=markdown).

## Generate an admin token
{: #setting-up-vault-dedicated-admin-token}
{: step}

To access the Vault UI for initial configuration, generate an admin token.

Admin tokens are intended for initial setup and emergency access only. Revoke them as soon as you complete your setup tasks.
{: important}

### Generating an admin token in the UI
{: #setting-up-vault-dedicated-admin-token-ui}
{: ui}

1. In your Secrets Manager instance dashboard, click **Create token** in the **Create new admin token** section.
2. Copy the generated admin token and store it securely. You'll need this token to sign in to the Vault UI.

### Generating an admin token from the CLI
{: #setting-up-vault-dedicated-admin-token-cli}
{: cli}

To generate a new Vault admin token by using the IBM Cloud CLI, run the following command.

```sh
ibmcloud secrets-manager-instance-management admin-token-create --id {instance_id}
```
{: pre}

The command returns the Vault admin token. Store it securely — you need this token to sign in to the Vault UI.

### Generating an admin token with the API
{: #setting-up-vault-dedicated-admin-token-api}
{: api}

```sh
curl -X POST \
  -H "Authorization: Bearer {iam_token}" \
  -H "Accept: application/json" \
  "https://{region}.secrets-manager.cloud.ibm.com/v2/instances/{id}/admintokens"
```
{: codeblock}

A successful request returns HTTP `201 Created`. The response contains a single `token` field — store it securely and use it to sign in to the Vault UI. The token is valid for 1 hour.

### Generating an admin token with Terraform
{: #setting-up-vault-dedicated-admin-token-terraform}
{: terraform}

To generate a Vault admin token with Terraform, use the `ibm_sm_admin_token` resource. The token is valid for 1 hour, and is automatically refreshed when it is close to expiry.

```terraform
resource "ibm_sm_admin_token" "sm_admin_token" {
  instance_id = "bfc50c2e-d66d-4f37-9ccf-9713f8325b39"
}
```
{: codeblock}

After the resource is created, the Vault admin token is available in the `token` attribute.

## Open the Vault UI
{: #setting-up-vault-dedicated-vault-ui}
{: step}

Use the Vault API endpoint to open the Vault UI and sign in with the admin token.

1. In the Secrets Manager instance dashboard, click **Launch web UI** to access the Vault native UI.
2. On the Vault sign-in page, use the admin token that you created and complete your initial Vault configuration.

## Revoke the admin token
{: #setting-up-vault-dedicated-revoke-token}
{: step}

After you finish the initial setup, revoke any active admin tokens to help reduce the risk of unintended access.

### Revoking admin tokens in the UI
{: #setting-up-vault-dedicated-revoke-token-ui}
{: ui}

1. In your Secrets Manager instance dashboard, click **Revoke** in the **Revoke all admin tokens** section.
2. Confirm the revocation when prompted.

Revoking the token immediately invalidates it and helps reduce the risk of unintended access.

### Revoking admin tokens from the CLI
{: #setting-up-vault-dedicated-revoke-token-cli}
{: cli}

To revoke all active Vault admin tokens by using the IBM Cloud CLI, run the following command.

```sh
ibmcloud secrets-manager-instance-management admin-tokens-delete --id {instance_id}
```
{: pre}

This operation immediately invalidates all admin tokens, requiring new tokens to be generated for future administrative access.

### Revoking admin tokens with the API
{: #setting-up-vault-dedicated-revoke-token-api}
{: api}

```sh
curl -X DELETE \
  -H "Authorization: Bearer {iam_token}" \
  "https://{region}.secrets-manager.cloud.ibm.com/v2/instances/{id}/admintokens"
```
{: codeblock}

A successful revocation returns a `204 No Content` status code.

## Next steps
{: #setting-up-vault-dedicated-next-steps}

After you sign in to Vault, you can continue with the initial configuration of your instance.

- To configure authentication methods for your teams and applications, see [Configuring authentication methods](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-dedicated-auth-methods&format=markdown).
- To integrate with your apps by using the Vault API, CLI, or SDKs, see [Integrating with your apps](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-integrate-with-apps-vault-dedicated&format=markdown).
- To review Vault API and CLI capabilities, see [API and CLI reference overview](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-dedicated-reference-overview&format=markdown).