Skip to content
This repository has been archived by the owner. It is now read-only.
Vault-UI — A beautiful UI to manage your Vault, written in React
JavaScript CSS Other
Branch: master
Clone or download
protetore and djenriquez Approle edition is sending local_secret_ids, which isn't supported on…
… edit (#251)

Fix a problem where closing the edit modal prevents you from open the
same approle again, unless you click another one
Latest commit 36266ea Jun 6, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
bin Remove nodemon from default run (#227) Jan 2, 2018
build Cross platform Desktop app (#85) Apr 8, 2017
kubernetes/chart/vault-ui Helm chart for vault-ui (#149) Jul 25, 2017
misc Cross platform Desktop app (#85) Apr 8, 2017
src Add logic to handle supplied auth token header (#220) Nov 21, 2017
.babelrc jsondiff+dependencies Mar 31, 2017
.dockerignore Cross platform Desktop app (#85) Apr 8, 2017
.eslintignore Cross platform Desktop app (#85) Apr 8, 2017
.eslintrc.json Add babel eslint parser Feb 17, 2017
.gitignore Added support for kubernetes authentication backend (#233) Jan 29, 2018 Update CHANGELOG Oct 1, 2017
Dockerfile Changed base image not majer version only so that security fixes and … Jan 29, 2018
LICENSE Update LICENSE Sep 24, 2017 Added support for kubernetes authentication backend (#233) Jan 29, 2018
docker-compose.yaml Remove nodemon from default run (#227) Jan 2, 2018
index.desktop.html Correct the dist reference for the electron app (#199) Oct 1, 2017
index.web.html Fix favicon (#188) Sep 24, 2017
main.js Cross platform Desktop app (#85) Apr 8, 2017
package.json Remove nodemon from default run (#227) Jan 2, 2018
postcss.config.js Upgrade to webpack v2 (#93) Apr 13, 2017
run-docker-compose-dev Fixes string parsing bug and warnings in run-docker-compose-dev (#242) May 24, 2018
server.js allows for server port to be configured via env var PORT (#162) Aug 16, 2017
shippable.yml Removing integration Nov 9, 2016
webpack.config.js Correct the dist reference for the electron app (#199) Oct 1, 2017
yarn.lock Maintenance: Upgrade packages (#200) Oct 1, 2017

Vault-UI Logo

Run Status Join the chat at


A beautiful way to manage your Hashicorp Vault


  • Easy to deploy as Web App
  • Desktop version works on Mac, Linux and Windows
  • Material UI Design
  • Integrated JSON Editor
  • Written in React


Desktop Version

Vault-UI Desktop is available for the following operating systems:

  • Windows
  • MacOS
  • Linux (32bit and 64bit AppImage)

Download the latest version from the release page and install/run the software

Web Version

Vault-UI can be deployed as a shared web app for your organization

Docker images are automatically built using an automated build on Docker Hub. We encourage that versioned images are used for production.

To run Vault-UI using the latest Docker image:

docker run -d \
-p 8000:8000 \
--name vault-ui \

Advanced configuration options

By default, connection and authentication parameters must be configured by clicking on the configuration cog on the login page. Using environment variables (via docker), an administrator can pre-configure those parameters.

Example command to pre-configure the Vault server URL and authentication method

docker run -d \
-p 8000:8000 \
--name vault-ui \

Supported environment variables:

  • PORT Sets the port for Vault-UI to listen on. (Default 8000)
  • CUSTOM_CA_CERT Pass a self-signed certificate that the system should trust.
  • NODE_TLS_REJECT_UNAUTHORIZED Disable TLS server side validation. (ex. vault deployed with self-signed certificate). Set to 0 to disable.
  • VAULT_URL_DEFAULT Sets the default vault endpoint. Note: protocol part of the url is mandatory. Example:
  • VAULT_AUTH_DEFAULT Sets the default authentication method type. See below for supported authentication methods.
  • VAULT_AUTH_BACKEND_PATH Sets the default backend path. Useful when multiple backends of the same type are mounted on the vault file system.
  • VAULT_SUPPLIED_TOKEN_HEADER Instructs Vault-UI to attempt authentication using a token provided by the client in the specified HTTP request header.

This defaults can be overridden if the user fills out the endpoint and auth method manually.

Current supported login methods:

Current supported management of backend auth methods:

In some cases, users might want to use middleware to authenticate into Vault-UI for purposes like SSO. In this case, the VAULT_SUPPLIED_TOKEN_HEADER may be populated with the name of the header that contains a token to be used for authentication.


Basic policy for Vault-UI users

A user/token accessing Vault-UI requires a basic set of capabilities in order to correctly discover and display the various mounted backends. Please make sure your user is granted a policy with at least the following permissions:


  "path": {
    "auth/token/lookup-self": {
      "capabilities": [
    "sys/capabilities-self": {
      "capabilities": [
    "sys/mounts": {
      "capabilities": [
    "sys/auth": {
      "capabilities": [


path "auth/token/lookup-self" {
    capabilities = [ "read" ]

path "sys/capabilities-self" {
    capabilities = [ "update" ]

path "sys/mounts" {
    capabilities = [ "read" ]

path "sys/auth" {
    capabilities = [ "read" ]


Secrets are now managed using the graphical josdejong/jsoneditor JSON editor. Schema validation is enforced on policies to aid the operator in writing correct syntax.

Secrets also are accessible directly by key from a browser by navigating to the URI /secrets/<backendtype>/<mountpoint>/key. For example, if you have a generic secret key of /hello/world/vault using the generic mount secret/, one can navigate to this directly through

Root key bias

By default, secrets will display as their raw JSON value represented by the data field in the HTTP GET response metadata. However, users can apply a "Root Key" bias to the secrets through the settings page. The "Root Key" will be used when reading, creating and updating secrets such that the value displayed in the UI is the value stored at the "Root Key". For example, if the secret at secret/hello is { "value": "world" }, setting the "Root Key" to value will update the UI such that the secret will display as simply "world" instead of { "value": "world" }.


Policies are managed also using the josdejong/jsoneditor JSON editor. Currently, GitHub and raw Tokens are the only supported authentication backends for associated policies.

Token Management

Users have the ability to create and revoke tokens, manage token roles and list accessors. The following permissions are needed at minimum for this feature:


  "path": {
     "auth/token/accessors": {
       "capabilities": [
     "auth/token/lookup-accessor/*": {
       "capabilities": [


path "auth/token/accessors" {
    capabilities = [ "sudo", "list" ]

path "auth/token/lookup-accessor/*" {
    capabilities = [ "read" ]

Response Wrapping

Vault-UI supports response-wrapping of secrets in generic backends. Wrapping custom JSON data is also supported.


Install the yarn package manager

With Docker

The command below will use Docker Compose to spin up a Vault dev server and a Vault UI server that you can log into with username "test" and password "test":


If major changes are made, be sure to run docker-compose build to rebuild dependencies.

Without Docker

The following will spin up a Vault UI server only. It will not set up Vault for you:

yarn run dev-pack &
yarn start


Vault-UI is licensed under BSD 2-Clause. See LICENSE for the full license text.


Vault-UI maintainers are humbly accepting donations as a way of saying thank you!

You can’t perform that action at this time.