Skip to content
ContextDataVault

Getting started

This guide gets you from zero to storing your first secret. It uses the standalone Docker setup, which includes a local PostgreSQL database.

Prerequisites

Section titled “Prerequisites”
  • Docker with Compose v2 (docker compose version)
  • ~2 GB free disk for the image and database

1. Configure your environment

Section titled “1. Configure your environment”

Copy the template and fill in the three required secrets:

Terminal window
cp .env.docker.example .env.docker
Variable How to generate
DB_PASSWORD openssl rand -base64 24
JWT_SECRET openssl rand -base64 48
MASTER_ENCRYPTION_KEY openssl rand -hex 32 (exactly 64 hex chars)

2. Start the service

Section titled “2. Start the service”
Terminal window
docker compose -f docker-compose.yml -f docker-compose.standalone.yml up -d

Verify it’s healthy:

Terminal window
curl http://localhost:4000/api/v1/health
# → {"status":"ok","deploymentMode":"device","timestamp":"..."}

3. Run first-time setup

Section titled “3. Run first-time setup”

This creates your tenant, an admin principal, and a default vault. It runs once.

Terminal window
curl -X POST http://localhost:4000/api/v1/auth/setup \
  -H "Content-Type: application/json" \
  -d '{
    "tenantName": "My Org",
    "adminName": "Admin",
    "adminEmail": "admin@example.com",
    "adminPassword": "your-secure-password-12+"
  }'

The response includes a short‑lived JWT and your vault.id. Save the vault ID — you need it for secret and token operations.

4. Issue a long-lived API token

Section titled “4. Issue a long-lived API token”

Use the JWT from setup to mint a token for ongoing use:

Terminal window
curl -X POST http://localhost:4000/api/v1/auth/tokens \
  -H "Authorization: Bearer <jwt-from-setup>" \
  -H "Content-Type: application/json" \
  -d '{"name":"my-service","scopes":["secrets:read","secrets:write","tokens:read","tokens:write"]}'

For all subsequent calls, authenticate with:

Authorization: Token <your-api-token>

5. Store your first secret

Section titled “5. Store your first secret”
Terminal window
curl -X POST http://localhost:4000/api/v1/secrets \
  -H "Authorization: Token <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"vaultId":"<vault-id>","name":"OPENAI_API_KEY","value":"sk-..."}'

Read it back (this read is audited):

Terminal window
curl http://localhost:4000/api/v1/secrets/<secret-id>/value \
  -H "Authorization: Token <your-api-token>"

Next steps

Section titled “Next steps”