Vault response wrapping is a delivery token, not durable secret storage

Vault response wrapping takes a response and places it in the cubbyhole of a single-use token. The caller receives the wrapping token instead of the underlying value. The intended recipient unwraps the token and receives the original response. The token is temporary and single use; a reused token should fail. This is useful for delivering AppRole SecretIDs, bootstrap credentials, and other values over a channel that should not retain a reusable secret.

The control is often misunderstood as encryption for a secret that can be stored indefinitely. Response wrapping has a short lifetime and a one-time use model. The wrapping token is itself a bearer credential during its lifetime. If it is logged, copied into a ticket, or left in a shell history, someone else can consume it first.…