30-Second Quickstart

Sovereign Vault is designed as a single static container. There are no external databases, no Redis caches, and no mandatory user accounts to configure.

1. Run with Docker Compose

Create a docker-compose.yml file:

services:
  sovereign-vault:
    image: oakai/sovereign-vault:latest
    container_name: sovereign-vault
    restart: unless-stopped
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
      - vault-data:/data
    ports:
      - "8443:8443"

volumes:
  vault-data:
    name: sovereign_vault_data

Start the daemon in background mode:

docker compose up -d

2. Retrieve Anti-Hijack Nonce

On cold boot, Sovereign Vault emits a single-use 64-character bootstrap nonce to container logs:

docker logs sovereign-vault | grep "Nonce:"

3. Initialize the Vault

Send an authenticated initialization request using the nonce header:

curl -s -X POST http://localhost:8443/v1/sys/init \
  -H "X-Vault-Bootstrap-Nonce: <YOUR_NONCE_HERE>"

Important: Save the returned 256-bit unseal key in your personal vault (Bitwarden, 1Password, or local OS keyring). Because Sovereign Vault has zero user accounts, losing this key makes the encrypted volume mathematically unrecoverable.

4. Storing & Retrieving Secrets

Store your first secret:

curl -X PUT http://localhost:8443/v1/secret/apps/api/db_password \
  -H "Content-Type: application/json" \
  -d '{"project": "production", "value": "my_super_secret_db_pass_123"}'

Retrieve the decrypted secret:

curl http://localhost:8443/v1/secret/apps/api/db_password