How to Install & Set Up OpenBao

Prerequisites

• ✓A Linux host

The model: encryption as a service

OpenBao isn't just a place to dump passwords — it's a server that mediates every read and write through auth methods (how a caller proves who it is: tokens, LDAP, Kubernetes service accounts) and policies (what that identity is allowed to do, expressed as HCL rules over paths). Secrets themselves live behind secrets engines; the KV engine used below is the simple key-value case, but database, PKI, and cloud-credential engines can hand out short-lived, dynamically generated credentials instead of static ones.

Install the OpenBao binary (any Linux distro)

curl -LO https://github.com/openbao/openbao/releases/download/v2.1.0/bao_2.1.0_linux_amd64.tar.gz
tar xzf bao_2.1.0_linux_amd64.tar.gz
sudo mv bao /usr/local/bin/
bao --version

Alternative — run OpenBao in Docker

docker run --cap-add=IPC_LOCK -d --name openbao -p 8200:8200 openbao/openbao:latest

Build from source

OpenBao is Go and fully open source under the MPL, so a from-source build is a genuine, documented option — not just a workaround.

git clone https://github.com/openbao/openbao.git
cd openbao
make dev

Start a dev server

The dev server runs in-memory, unsealed, and pre-authenticated — perfect for learning, never for production.

bao server -dev

Store and read a secret

export BAO_ADDR='http://127.0.0.1:8200'
bao status
bao kv put secret/my-app password=s3cr3t
bao kv get secret/my-app

How a real server starts: init and unseal

The -dev server skips two steps that matter in production. bao operator init generates the root encryption key and splits it into a configurable number of unseal key shares using Shamir's Secret Sharing — by default you need any 3 of 5 shares to reconstruct the key. Every time the server process restarts, it comes up sealed (unable to decrypt anything) until enough shares are supplied again with bao operator unseal.

bao operator init                 # prints 5 unseal key shares + a root token — store them safely, this only happens once
bao operator unseal                # run 3 times, once per distinct key share
bao status                         # Sealed: false once enough shares are in

Enable a secrets engine and scope access with a policy

bao secrets enable -path=apps kv-v2

path "apps/data/my-app" {
  capabilities = ["read"]
}

bao policy write app-readonly app-readonly.hcl
bao token create -policy="app-readonly"

Related Guides