Private token storage (cubbyhole)

Cubbyhole is a secrets engine that is always enabled and mounted at cubbyhole/. Every token has its own isolated storage in it: other tokens, including root, cannot see it. When a token expires or is revoked, its storage is deleted. Response wrapping is built on this.

Goal

Make sure that data in cubbyhole is available only to the token that created it and disappears together with it.

Prerequisites

To follow this example, you need:

• A Stronghold token with permission to create tokens.
• The default policy on the created tokens: it allows working with cubbyhole/*.

Step 1. Write data with your token

Write a note to cubbyhole with your token and read it:

d8 stronghold write cubbyhole/notes text="personal note"
d8 stronghold read cubbyhole/notes

Step 2. Create a second token and check isolation

Create a second token and compare what each token sees at the same path:

1. Create a token with the default policy:

   TOKEN2=$(d8 stronghold token create -policy=default -ttl=10m -field=token)

2. The second token does not see the first token’s note, although the path is the same:

   # Read the note with the second token.
   STRONGHOLD_TOKEN="$TOKEN2" d8 stronghold read cubbyhole/notes

   The command returns No value found at cubbyhole/notes.

3. The second token has its own storage:

   STRONGHOLD_TOKEN="$TOKEN2" d8 stronghold write cubbyhole/notes text="second token note"
   STRONGHOLD_TOKEN="$TOKEN2" d8 stronghold read cubbyhole/notes
   d8 stronghold read cubbyhole/notes

   The first read command returns the second token’s note, and the second returns the first token’s note.

Step 3. Check that data is deleted together with the token

Revoke the second token. Its storage is deleted with it, and the data cannot be recovered:

d8 stronghold token revoke "$TOKEN2"

Verification

The first token’s note is still in place:

d8 stronghold read -field=text cubbyhole/notes

Usage

Cubbyhole is suitable for temporary storage of data that must not be available to anyone except one token: intermediate script results, one-time values when handing over secrets. For long-term storage and shared access, use KV.

Cleanup

Delete the note of the first token:

d8 stronghold delete cubbyhole/notes

Additional resources

• Cubbyhole secrets engine
• Response wrapping