HashiCorp Vault — Dev Server

3 minute read

The dev server is an in-memory, pre-configured Vault instance that makes learning and experimentation fast. We’ll use it throughout this tutorial for hands-on labs.

Start the Dev Server

# Start dev server with a predictable root token
vault server -dev -dev-root-token-id="my-root-token"

Expected output:

==> Vault server configuration:

             Api Address: http://127.0.0.1:8200
                     Clu Address: https://127.0.0.1:8201
          Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")
                 Storage: inmem
                 Version: Vault v1.15.4

==> WARNING: dev mode is enabled!

The unseal key and root token are displayed below in case you
want to seal/unseal the Vault or re-authenticate.

Unseal Key: abc123...
Root Token: my-root-token

Development mode should NOT be used in production installations!

💡 Tip: The dev server runs in the foreground. Open a second terminal for Vault commands.

Configure Your Shell

In a new terminal window, set up the environment:

# Point CLI to the dev server
export VAULT_ADDR='http://127.0.0.1:8200'

# Authenticate with the root token
export VAULT_TOKEN='my-root-token'

# Verify connection
vault status

Expected output:

Key             Value
---             -----
Seal Type       shamir
Initialized     true
Sealed          false
Total Shares    1
Threshold       1
Version         1.15.4
Build Date      2024-01-26T14:53:40Z
Storage Type    inmem
Cluster Name    vault-cluster-abc123
Cluster ID      12345678-abcd-efgh-ijkl-123456789012
HA Enabled      false

⚠️ Note: Sealed: false — the dev server is always unsealed. In production, you must explicitly unseal Vault.

Explore What’s Pre-configured

The dev server comes with sensible defaults for learning:

Secrets Engines

vault secrets list

Expected output:

Path          Type         Accessor              Description
----          ----         --------              -----------
cubbyhole/    cubbyhole    cubbyhole_abc123      per-token private secret storage
identity/     identity     identity_abc123       identity store
secret/       kv           kv_abc123             key/value secret storage
sys/          system       system_abc123         system endpoints (barrier dependent)

The secret/ engine (KV v2) is enabled by default — ready for storing secrets.

Auth Methods

vault auth list

Expected output:

Path      Type     Accessor               Description
----      ----     --------               -----------
token/    token    auth_token_abc123      token based credentials

Only token auth is enabled. We’ll add more auth methods in Chapter 4.

Your First Secret

# Write a secret
vault kv put secret/hello name="World" greeting="Hello"

# Read it back
vault kv get secret/hello

Expected output:

====== Data ======
Key         Value
---         -----
greeting    Hello
name        World

# Read a specific field
vault kv get -field=greeting secret/hello

Expected output:

Hello

Access the Web UI

The dev server includes a web UI:

  1. Open your browser to http://127.0.0.1:8200/ui
  2. Enter the root token: my-root-token
  3. Click Sign In

You’ll see the Vault dashboard with:

  • Secrets engines listed on the left
  • A search bar for secrets
  • Navigation to auth methods, policies, and tools

Dev Server Flags

Flag Description Example
-dev-root-token-id Set a custom root token vault server -dev -dev-root-token-id="test"
-dev-listen-address Change listen address vault server -dev -dev-listen-address="0.0.0.0:8200"
-dev-no-store-token Don’t store root token in token helper vault server -dev -dev-no-store-token
-log-level Set log verbosity vault server -dev -log-level=trace

Dev Server with Docker Compose

For a reproducible lab environment:

# docker-compose-vault-dev.yml
services:
  vault:
    image: hashicorp/vault:1.15
    container_name: vault-dev
    ports:
      - "8200:8200"
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: my-root-token
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
      VAULT_LOG_LEVEL: info
    cap_add:
      - IPC_LOCK
    restart: unless-stopped

# Start
docker compose -f docker-compose-vault-dev.yml up -d

# Set environment
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='my-root-token'

# Verify
vault status

# Stop and clean up
docker compose -f docker-compose-vault-dev.yml down

Common Issues

Issue Cause Fix
Error checking seal status VAULT_ADDR not set export VAULT_ADDR='http://127.0.0.1:8200'
permission denied VAULT_TOKEN not set or wrong export VAULT_TOKEN='my-root-token'
address already in use Another process on port 8200 Kill the process or use a different port
Data lost after restart Dev server uses in-memory storage Expected behavior — use production mode for persistence

Quick Reference

Command Description
vault server -dev Start dev server
vault server -dev -dev-root-token-id="token" Custom root token
export VAULT_ADDR='http://127.0.0.1:8200' Set server address
export VAULT_TOKEN='my-root-token' Set authentication token
vault status Check server status
vault kv put secret/path key=value Write a secret
vault kv get secret/path Read a secret

Next: Production Server

You may also enjoy