Authentication

The CLI supports two authentication mechanisms. Browser SSO is the default for interactive use. API access tokens are the primary mechanism for headless and CI/CD use.

Browser (SSO)

Running vault login opens a browser window against login.veevavault.com. Works with both SSO and standard Vault users.

vault login --vault myorg.veevavault.com

The browser window closes after a successful login. Credentials are stored locally under ~/.vault/ for subsequent commands.

API Access Token

Pass --access-token on any vault-facing command. No prior vault login is required.

To store the token for subsequent commands:

vault login --vault myorg.veevavault.com --access-token veeva-vault-abc123

To authenticate a single command without storing credentials:

vault query "SELECT id__v FROM documents__v" \
  --access-token veeva-vault-abc123 \
  --env myorg.veevavault.com

Session ID

Pass a pre-existing Vault API session token with --session-id:

vault login --vault myorg.veevavault.com --session-id <SESSION_ID>

Username & Password

Basic authentication uses your Vault username and password directly. The CLI never persists the password. Only the resulting session token is stored.

vault login --vault myorg.veevavault.com --username user@example.com --password <PASSWORD>

CI/CD (headless)

In non-interactive environments, pass --access-token directly on each command. Use --env to specify the target vault:

vault config pull --env myorg.veevavault.com --access-token $VAULT_TOKEN
vault config push --env myorg.veevavault.com --access-token $VAULT_TOKEN --force

Manage stored credentials

To list stored credentials:

vault login creds list

To remove stored credentials:

vault logout

See the vault login reference for the full credential management surface.