Skip to main content
← Back to list
01Issue
FeatureShippedSwamp CLIPublic
Assigneesstack72

Relationships

#2128 access token mint --vault: surface the secure shared-vault handoff

Opened by stack72 · 9/13/2026· Shipped 9/14/2026

Problem

When a datastore control-plane vault is active, swamp access token mint --vault <vault> is correctly rejected: server-token secrets must remain in the control-plane vault rather than using a user-configured vault as their primary store.

However, --vault was also the discoverable way for an operator to express the actual onboarding need: deliver a newly minted <name>.<secret> credential to a shared vault that the token holder can access from another machine. The rejection currently only suggests swamp access token reveal <name>, which sounds like it will print the secret to the terminal. This makes the supported no-terminal handoff difficult to discover.

The capability already exists through command composition:

swamp access token reveal <name> --repo-dir <repo> --yes --json \
  | jq -re .token \
  | swamp vault put <vault> server-token-<name> --yes

reveal --json emits the full credential to the pipe, and vault put accepts stdin. The credential does not appear in the terminal, shell history, or command arguments. The holder can then read the shared-vault secret on their own machine.

Requested Change

Make this supported handoff visible where operators encounter the rejected --vault flow.

  • Update the mint --vault and rotate --vault rejection messages to explain that the option cannot select token storage when a datastore is configured.
  • Tell the operator to mint or rotate without --vault, then show the exact reveal --json | jq | vault put command using the requested vault and token name.
  • Add the same guidance to token onboarding/help documentation.
  • Clarify that this delivers a copy of the full credential to a user vault; it does not change the token secret's control-plane storage.

Non-goals

  • Do not reintroduce mint --vault as token storage selection.
  • Do not add reveal --vault; the existing composable pipeline already provides the transfer without adding a new credential-delivery command.
02Bog Flow
OPENTRIAGEDIN PROGRESSSHIPPED+ 1 MOREASSIGNED+ 5 MOREREVIEW+ 9 MOREPR_MERGEDSHIPPED

Shipped

9/14/2026, 4:36:26 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack729/14/2026, 3:25:33 PM

Sign in to post a ripple.