Managing admin tokens

IBM Cloud Vault Dedicated clusters operate from the admin namespace, unlike a self-managed Vault Enterprise cluster which operates from the root namespace.T he root namespace is reserved for service operations and not customer accessible.

Admin tokens provide administrative access to your Vault Dedicated cluster admin namespace and are required for initial setup and ongoing administrative operations. You generate and revoke admin tokens through the Secrets Manager Instance Management API.

Treat admin tokens as highly sensitive credentials. Generate them only when needed for administrative tasks, and revoke them immediately after use.

How admin token generation works

Each time you request an admin token, the service creates a non-renewable admin token with a time-to-live (TTL) of 1 hour. The token expires automatically after 1 hour and cannot be renewed.

The admin token provides administrative access to your Vault Dedicated cluster's admin namespace. It can be used to create namespaces, configure secrets engines and authentication methods, manage policies, and perform other administrative tasks. The admin token does not provide access to service-managed operations such as sealing or unsealing Vault, cluster scaling, and storage management, those operations are performed exclusively by the IBM Cloud Vault Dedicated service.

Recommended practices

The admin token is intended for initial configuration and emergency access only. For day-to-day operations, configure an authentication method (such as AppRole, Kubernetes, or JWT) within your Vault instance so that your teams and applications can generate tokens without depending on the admin token.

  • Use the admin token to perform initial setup: enable secrets engines, configure authentication methods, and define access policies.
  • Revoke the admin token after each administrative session.
  • Avoid storing the admin token in scripts or automation. Use a dedicated authentication method instead.
  • A rate limit applies to admin token generation to prevent abuse. If you exceed the limit, wait before requesting a new token.

API operations

The Instance Management API exposes the following operations for managing admin tokens:

  • Generate an admin token – Creates a new Vault admin token that you can use to authenticate to the Vault API and UI. See Generating an admin token in the Instance Management API reference.

  • Revoke all admin tokens – Immediately invalidates all active admin tokens for your instance, requiring new tokens to be generated for future administrative access. See Revoking all admin tokens in the Instance Management API reference.

For authentication requirements, base URL details, and full request and response specifications for both operations, see Instance Management API reference.