OpenBao Rust SDK

openbao is a secure, async Rust SDK for OpenBao. The crate name on crates.io is intended to be openbao; Rust imports are lowercase:

use openbao::Client;

The current release target is 0.1.0: secure client construction, direct token authentication, AppRole login, KV v2 read/write/list/delete helpers, system health and seal-status helpers, a raw JSON request layer for unsupported endpoints, a hardened local OpenBao dev instance, and a release process gated by formatting, clippy, tests, docs, cargo audit, cargo deny, SBOM generation, GitHub CodeQL default setup, and pentest review.

OpenBao Rust SDK is dual-licensed under MIT or Apache-2.0.

What Works Today

Client, Transport, And TLS

Authentication

Secret Engines

System Backend And Operations

Security And Release Process

See API Coverage and Release Plan for the precise road to 1.0.0.

Why OpenBao Rust SDK

• Security first: HTTPS by default, no redirects, TLS floor, strict path validation, zeroized intermediate auth buffers, and secret-aware types.
• OpenBao focused: follows the current OpenBao /v1 HTTP API and documented token header behavior.
• Small dependency surface: keeps runtime dependencies narrow and reviewed.
• Typed where it matters: safe typed helpers for common workflows, with a raw JSON escape hatch while coverage grows.
• Release discipline: security checks, SBOM, GitHub CodeQL default setup, and pentest review are treated as release inputs, not afterthoughts.

Quick Start

Add the crate:

[dependencies]
openbao = "0.1"
secrecy = "0.10.3"
serde = { version = "1.0.228", features = ["derive"] }
tokio = { version = "1.52.3", features = ["macros", "rt-multi-thread"] }

Read a KV v2 secret:

use openbao::{Client, Result};
use secrecy::SecretString;
use serde::Deserialize;

#[derive(Deserialize)]
struct DbCredentials {
    username: String,
    password: SecretString,
}

#[tokio::main]
async fn main() -> Result<()> {
    let token = SecretString::from(std::env::var("BAO_TOKEN").unwrap_or_default());
    let client = Client::new("https://bao.example.com:8200")?.with_token(token);

    let secret = client
        .kv2("secret")?
        .read::<DbCredentials>("production/database")
        .await?;

    println!("username: {}", secret.data.username);
    let _password = secret.data.password;
    Ok(())
}

Authenticate with AppRole:

use openbao::{Client, Result};
use secrecy::SecretString;

#[tokio::main]
async fn main() -> Result<()> {
    let client = Client::new("https://bao.example.com:8200")?;
    let role_id = SecretString::from(std::env::var("APPROLE_ROLE_ID").unwrap_or_default());
    let secret_id = SecretString::from(std::env::var("APPROLE_SECRET_ID").unwrap_or_default());

    let (client, login) = client.login_approle(role_id, secret_id).await?;
    let health = client.sys().health().await?;

    let _token_accessor = login.accessor;
    println!("openbao version: {}", health.version);
    Ok(())
}

Local OpenBao Dev Instance

The local dev stack uses Podman, TLS, a private CA, and loopback-only ports in the requested 994x range.

scripts/openbao_dev.sh up

Endpoints:

• API: https://127.0.0.1:9940
• Cluster: https://127.0.0.1:9941
• CA certificate: deploy/podman/dev-state/tls/dev-ca.crt

Initialize and unseal OpenBao using bao operator init and bao operator unseal, then export BAO_ADDR=https://127.0.0.1:9940 and BAO_CACERT=deploy/podman/dev-state/tls/dev-ca.crt.

Release Discipline

Run the normal local checks:

scripts/checks.sh

Run the 0.1.0 release gate:

scripts/release_0_1_gate.sh

No release tag should be cut unless the matching pentest report status is reviewed and recorded in the release notes.