openbao/openbao

OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

Summary

OpenBao is an open-source secrets management tool written in Go for storing, distributing, and managing sensitive data such as API keys, certificates, and credentials. It is licensed under MPL-2.0 and developed under open-governance principles, with user-facing documentation hosted on the project website.

What it is useful for

OpenBao addresses the practical problem of giving applications safe access to credentials without scattering them across config files or environment variables. The README highlights several concrete scenarios where it is useful:

• Centralized secret storage: arbitrary key/value secrets are encrypted before being written to persistent storage, with documented backends including local disk and PostgreSQL.
• Short-lived credentials for external systems: it can generate secrets on demand (for example, an AWS keypair with scoped permissions, or SQL database credentials) and automatically revoke them when the lease expires, reducing the window of exposure if a credential leaks.
• Application-level encryption without designing custom crypto: clients can ask OpenBao to encrypt or decrypt values while the encryption material stays inside OpenBao, so the encrypted data can safely live in places like a SQL database.
• Operational control: leases, renewals, and tree-based revocation (revoking a single secret, a user's tree of secrets, or a particular type) support key rolling and intrusion response without code changes.

How engineers can use it

The README directs users to the documentation site for full usage but documents the local development workflow directly. Engineers who want to try it locally should first install Go; the CI toolchain version is pinned in .go-version, though the README notes that the latest local toolchain is typically fine.

Build the bao binary from source:

mkdir -p bin
go build -o bin/bao .

Start a server in development mode for experimentation:

go run . server -dev

Run tests against a specific package with go test ./some/package. The project uses Go Modules, so the repository should be cloned outside the GOPATH. A Makefile is included for more advanced build tasks, and the repo also contains the website and web UI under the website/ and ui/ subtrees, each with their own READMEs.

A documented limitation to be aware of: only two packages are intended to be imported by other Go projects, github.com/openbao/openbao/api/v2 and github.com/openbao/openbao/sdk/v2. The README explicitly states that importing the top-level github.com/openbao/openbao module is unsupported, and the maintainers say they will not fix bugs or refactor internals to make that easier.