Vault Associate · Domain 3 of 9

Vault Associate Domain 3: Vault tokens

Tokens are the core credential in Vault. This group tests service versus batch tokens, root token lifecycle, accessors, TTL behavior, orphan tokens, and how to create a token that fits a particular need.

Exam weight estimate
Not published
Official objectives
6
Estimated questions estimate
~9
Suggested study time estimate
6–8 hrs

About 12 min read Reviewed October 2026

Overview

Every authenticated request to Vault carries a token, and this objective group covers how those tokens behave. HashiCorp lists six objectives: choosing between service and batch tokens, root token uses and lifecycle, the purpose of token accessors, the impact of time-to-live, orphaned tokens, and creating tokens to meet a need. Service tokens carry an hvs. prefix and are persisted, renewable and able to create children; batch tokens carry an hvb. prefix and are lightweight encrypted blobs with fewer features.

You also need the token hierarchy. A token created by another token becomes its child, and revoking the parent revokes every descendant along with their leases, unless a child was created as an orphan. TTLs, max TTLs, periodic tokens and use limits control how long a token lives, and accessors let operators manage a token without seeing its value.

How it's tested

Token questions tend to be scenario based or flag based. A workload is described and you pick a token type, or a vault token create command is shown and you predict the result. Know the prefixes, which features each type lacks, and how parent and child revocation works.

  • Service or batch

    A workload's scale, renewal and replication needs are described, and you choose the token type that fits.

  • Lifecycle prediction

    A parent is revoked or a TTL expires, and you decide which tokens and leases survive.

  • Build the token

    A requirement is given, such as no maximum lifetime or ten uses, and you choose the vault token create flags that meet it.

Reasoning it through

A service must keep its token indefinitely, renewing it every hour, and must not be cut off when the operator who created it leaves. A long TTL alone still hits a max TTL, and a normal child dies with its parent. A periodic token renews without a max TTL, and creating it as an orphan removes the parent dependency, so an orphan periodic token meets both needs.

Objectives 6

Official objectives from the HashiCorp outline, in outline order.

3a Choose between service and batch tokens based on use caseComparing the two token types and when each fits.
What it means
Service tokens are the full-featured default, stored in Vault's storage. Batch tokens are encrypted blobs that Vault does not persist, so they are cheap to create at high volume but support fewer operations.
What to understand
Service tokens can be renewed, can create child tokens, have accessors, can be periodic and can be root tokens. Batch tokens cannot be renewed, cannot create children, have no accessor and cannot be root; their lifetime is fixed at creation. Batch tokens from a primary cluster can be used on performance replication secondaries, which makes them useful for distributed, short-lived workloads. Leases created by a batch token are tied to its parent, or revoked when the batch token expires if it is an orphan.
How it shows up
A high-volume, short-lived workload points to batch tokens; renewal or child tokens point to service tokens.
Common confusion
Assuming batch tokens can be renewed or revoked through an accessor.
3b Describe root token uses and lifecycleWhen root tokens exist, how to generate them and why to revoke them.
What it means
A root token has the root policy and can do anything in Vault. The initial root token comes from vault operator init, and HashiCorp recommends using root tokens only for initial setup or emergencies, then revoking them.
What to understand
Root tokens have no TTL, so they do not expire on their own. They can be created by vault operator init, by an existing root token, or with vault operator generate-root, which requires a quorum of unseal or recovery key holders and gives an encoded token to decode with a one-time password or PGP key. After setting up auth methods and admin policies, revoke the root token and generate a new one only when needed.
How it shows up
Questions ask how to obtain a root token when none exists, or what should happen to it after setup.
Common confusion
Thinking a lost root token makes Vault unrecoverable; generate-root with the key holders creates a new one.
3c Explain the purpose of token accessorsReferences that manage a token without revealing its value.
What it means
A token accessor is a separate value returned when a service token is created. It can be used to look up, renew or revoke the token, and to check its capabilities, without exposing the token itself.
What to understand
Accessors appear in token create and login responses and in audit logs. Operators or tooling can store accessors to manage tokens they never see, which supports revocation workflows. An accessor cannot be used to authenticate or read secrets. Listing accessors requires sudo on auth/token/accessors. Batch tokens have no accessor, which is one of their main limitations.
How it shows up
A scenario requiring revocation of a token whose value is unknown points to the accessor.
Common confusion
Believing an accessor can authenticate requests in place of the token.
3d Explain the impact of time-to-liveHow TTL, max TTL and renewal control token lifetime.
What it means
Every non-root token has a TTL, the time remaining before it expires, and an effective max TTL that renewals cannot exceed. When a token expires, Vault revokes it along with its child tokens and leases.
What to understand
The system default TTL and max TTL are 768 hours (32 days), and mounts, auth roles and tokens can set lower values. Renewal resets the TTL from the current time up to the max TTL, rather than adding time without limit. Periodic tokens are the exception: they have no max TTL and keep living as long as they are renewed within each period. Tokens can also be limited by number of uses with -use-limit.
How it shows up
Expect questions on what happens at max TTL, or which setting lets a token outlive the max TTL.
Common confusion
Expecting renewal to extend a token past its max TTL; only periodic tokens avoid that ceiling.
3e Explain orphaned tokensTokens without a parent and how revocation treats them.
What it means
An orphan token has no parent, so it is the root of its own token tree and is not revoked when the token that created it is revoked.
What to understand
Normally, tokens form a tree and revoking any token revokes all its descendants. Orphans break that chain. They can be created with vault token create -orphan, which requires sudo or root, through the auth/token/create-orphan endpoint, or through a token role configured with orphan set to true. Tokens issued by auth method logins are effectively orphans because they have no parent token. Revoking a parent with -mode=orphan revokes only that token and turns its children into orphans.
How it shows up
Scenarios where a token must survive its creator's revocation point to orphan tokens.
Common confusion
Confusing orphan tokens with periodic tokens; one removes the parent, the other removes the max TTL.
3f Describe how to create tokens based on needUsing vault token create flags and token roles to shape tokens.
What it means
This objective covers creating tokens with the right type, policies, TTL, period, use limit and parent relationship, using vault token create or the auth/token/create API, often through token roles.
What to understand
Common flags include -policy, -ttl, -explicit-max-ttl, -period, -use-limit, -orphan, -type=batch and -role. Token roles under auth/token/roles predefine allowed policies, orphan behavior, period and type so less-privileged users can mint consistent tokens. A child token cannot receive policies its parent lacks unless created through a role or with sudo. vault token lookup shows the resulting properties, and vault token renew and vault token revoke manage the lifecycle.
How it shows up
A requirement is described, and you choose the flags or role settings that produce the right token.
Common confusion
Using -ttl when the requirement needs a token with no maximum lifetime, which calls for -period.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Service token

    Default, persisted token type with an hvs. prefix.

    Remember
    Renewable, has an accessor, can create children.
    Tested as
    Type choice questions.
    Trap
    Using it for very high-volume short tasks.

  • Batch token

    Unpersisted encrypted token with an hvb. prefix.

    Remember
    Not renewable, no accessor, no children.
    Tested as
    Type choice questions.
    Trap
    Expecting renewal or accessor support.

  • Root token

    Token with the root policy and no TTL.

    Remember
    Revoke after setup; regenerate with key holders.
    Tested as
    Lifecycle questions.
    Trap
    Keeping it for daily administration.

  • vault operator generate-root

    Creates a new root token from a key quorum.

    Remember
    Needs unseal or recovery key shares.
    Tested as
    Recovery questions.
    Trap
    Thinking a lost root token is permanent.

  • Token accessor

    Reference value for managing a token.

    Remember
    Look up, renew or revoke without the token.
    Tested as
    Revocation scenarios.
    Trap
    Trying to authenticate with it.

  • TTL and max TTL

    Remaining lifetime and its ceiling.

    Remember
    System default for both is 768 hours.
    Tested as
    Expiry questions.
    Trap
    Expecting renewal beyond max TTL.

  • Periodic token

    Token renewed within each period with no max TTL.

    Remember
    Lives as long as it keeps renewing.
    Tested as
    Long-running service scenarios.
    Trap
    Confusing it with an orphan token.

  • Orphan token

    Token with no parent.

    Remember
    Survives revocation of its creator.
    Tested as
    Hierarchy questions.
    Trap
    Assuming all tokens die with a parent.

  • Token hierarchy

    Parent and child tokens form a tree.

    Remember
    Revoking a parent revokes descendants.
    Tested as
    Cascading revocation questions.
    Trap
    Forgetting child leases are revoked too.

  • Use limit

    Maximum number of requests a token can make.

    Remember
    Set with -use-limit.
    Tested as
    Token creation questions.
    Trap
    Confusing uses with TTL.

  • Token role

    Template that defines token settings.

    Remember
    Lets users create consistent tokens safely.
    Tested as
    Creation questions.
    Trap
    Ignoring roles as a delegation tool.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Service vs. batch tokens

ConceptMeaningKey differenceCommon trap
Service token Persisted, full-featured token Renewable, children, accessor Using it for massive token churn
Batch token Encrypted, unpersisted blob Fixed lifetime, no children Assuming it can be renewed

Ways to extend or detach a token

ConceptMeaningKey differenceCommon trap
Long TTL Token lasts longer before expiring Still capped by max TTL Treating it as unlimited
Periodic token Renew within each period No max TTL Forgetting it must be renewed
Orphan token No parent token Survives parent revocation Thinking it removes TTL limits

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Renew a batch token

    What candidates pick
    Renew a batch token to extend a job.
    Why it looks right
    Renewal works for service tokens.
    Why it's wrong
    Batch tokens have a fixed lifetime and cannot be renewed; use a service token if renewal is needed.

    Clue to watch for The workload needs renewal or a longer run.

  2. Root tokens expire

    What candidates pick
    Wait for the root token to expire after setup.
    Why it looks right
    Most tokens have TTLs.
    Why it's wrong
    Root tokens have no TTL, so they persist until explicitly revoked.

    Clue to watch for The scenario asks how to secure Vault after initialization.

  3. Accessor as credential

    What candidates pick
    Use the accessor to read a secret.
    Why it looks right
    It looks like a token value.
    Why it's wrong
    An accessor can look up, renew or revoke a token but cannot authenticate any request.

    Clue to watch for A team has only the accessor.

  4. Long TTL for forever

    What candidates pick
    Set a very large TTL so a service token never expires.
    Why it looks right
    A bigger TTL seems to solve expiry.
    Why it's wrong
    The max TTL still caps the token; a periodic token renewed each period has no max TTL.

    Clue to watch for A service must run indefinitely.

  5. Children outlive parent

    What candidates pick
    Expect child tokens to keep working after the parent is revoked.
    Why it looks right
    Each token feels independent.
    Why it's wrong
    Revocation cascades to all descendants unless they were created as orphans.

    Clue to watch for An operator who created tokens is offboarded.

  6. Orphan removes TTL

    What candidates pick
    Create an orphan token so it never expires.
    Why it looks right
    Orphans sound unbounded.
    Why it's wrong
    Orphan status only removes the parent link; TTL and max TTL still apply.

    Clue to watch for Requirement mentions both lifetime and parent.

Answer framework

Use these steps to settle any Domain 3 token scenario quickly.

  1. Decide whether the workload needs renewal, child tokens or an accessor; if any is required, choose a service token, otherwise consider a batch token.
  2. Check whether the token must outlive its creator, and if so create it as an orphan through -orphan or a token role.
  3. Check whether the token must run indefinitely, and if so make it periodic rather than raising the TTL.
  4. Apply TTL, max TTL and use-limit rules to predict when the token and its leases are revoked.
  5. For root access, use generate-root with key holders only when needed, then revoke the root token afterwards and rely on scoped admin policies for daily work.

Practice question

An operations team runs thousands of short-lived jobs per minute across a primary cluster and its performance replication secondaries. Each job needs a token for under five minutes and never renews it or creates child tokens. Which token type is the best fit?

Want more like this? The Vault Associate practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Work through tokens on a dev server. Create a service token and a batch token, then compare vault token lookup output for each: prefix, accessor, renewable flag and TTL. Try renewing the batch token and creating a child from it to see the errors for yourself. Next, create a parent token, a child and an orphan, revoke the parent, and confirm which tokens still work.

Then focus on lifetime. Create a token with a short TTL and explicit max TTL, renew it several times and watch it hit the ceiling. Create a periodic token and renew it past where a normal token would stop. Use the accessor from one token to look it up and revoke it from a different session.

Finally, practise generate-root on a dev cluster initialised with real unseal keys, since the multi-step flow with a one-time password appears in questions. Summarise each token feature on a flashcard and review missed practice questions against the token documentation.

FAQ

What share of the Vault Associate exam is about Vault tokens?

Vault tokens has no published weight. With six objectives it ties for the second-largest group, so we plan for about nine questions, and token behavior also shapes lease questions.

When should I use batch tokens?

Use them for high-volume, short-lived workloads that do not need renewal, child tokens or accessors, especially when tokens must work on performance replication secondaries.

Do root tokens expire?

No. Root tokens have no TTL, so revoke them once setup is complete and generate a new one with vault operator generate-root only when needed.

What can a token accessor do?

It can look up, renew and revoke the token and check its capabilities. It cannot be used to authenticate or access secrets.

How do I make a token that never reaches a max TTL?

Create a periodic token with -period. As long as it is renewed within each period, it has no maximum lifetime.

What is an orphan token?

A token with no parent. It is not revoked when the token that created it is revoked, and it is created with -orphan, a token role or the create-orphan endpoint.

What is the default token TTL?

The system default TTL and max TTL are both 768 hours, which is 32 days. Mounts, roles and individual tokens can set shorter values.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered service and batch tokens, root tokens, accessors, TTL and orphans. Test whether you can predict token behavior in exam scenarios.

Take the Vault Associate practice test Check your Vault Associate readiness

Keep going