01
Secure secret storage
Encrypted prior to writing, so raw storage access is not enough to read the secret.
Secrets, certificates and keys
A secret is not a stored string.
It is a lease.
OpenBao manages, stores and distributes sensitive data — and all secrets in OpenBao have a lease associated with them. At the end of the lease OpenBao automatically revokes the secret. Clients renew through built-in APIs, or they let it expire.
Why it exists
“Understanding who is accessing what secrets is already very difficult and platform-specific. Adding on key rolling, secure storage, and detailed audit logs is almost impossible without a custom solution.”
— project README
The lease book
illustrative rows — the operations and their outcomes are the project’sOperation
Entry
Lease
At expiry
DYNAMIC
AWS keypair, generated on demandAn application asks for credentials; OpenBao mints a keypair with valid permissions.
held
Revokedautomatically, after the lease is up
STATIC
Arbitrary key/value secretEncrypted before it is written to persistent storage — disk, PostgreSQL, and more.
held
Revokedor renewed through the built-in API
ENCRYPT
Data encrypted without being storedSecurity teams define the parameters; developers store ciphertext wherever they like.
—
Nothing heldthere is no secret at rest to revoke
REVOKE
A tree of secrets, not one leafAll secrets read by a specific user, or all secrets of a particular type.
cut
Immediatekey rolling, or locking down after an intrusion
Rows are illustrative examples of the published operations. No customer, volume or latency figure is shown.
02
Dynamic secrets
Generated on demand for systems such as AWS or SQL databases, then revoked.
03
Leasing and renewal
Every secret carries a lease. Renewal is an API call you have to keep making.
04
Revocation
Not only single secrets — a whole tree, in one operation.
Community-run under open-governance principles, intended under an OSI-approved open-source license. Security disclosures go to the OpenSSF list the project publishes, not to a form.