Vault / Quickstart

Get running.

Install, configure, store a file, get a signed receipt, and verify what the receipt proves.

Encrypted storage, signed receipts, and append-only proof history.

Prerequisites

Linux x86_64 — supported
Linux arm64 — supported
macOS arm64 — planned
macOS x86_64 — planned
Windows — planned
A server URL
A claim code or token

Step 1

Install and configure

Binary installer for Linux x86_64 and Linux arm64:

$ curl -fsSL https://vault.auroranode.com/vault/install.sh | sh

Installs auroravault to ~/.local/bin/. Creates a vault symlink if no existing vault command is found. To update: auroravault update.

Available Linux binaries are built against glibc 2.31 and run on distributions meeting that baseline. Other platform binaries are planned.

If you have a claim code, exchange it now to create your account and receive a token:

$ vault auth create --code clm_your_code_here

If you already have a token, continue with setup.

Interactive wizard — generates your local Ed25519 keypair, sets the server URL, and stores your bearer token.

$ vault setup

Or non-interactive:

$ vault init $ vault config set api_url https://vault.auroranode.com $ vault config set-token --token vlt_your_token_here

Check connectivity:

$ vault status server ● reachable auth ● valid keys ● present version client 0.17.0 home default ~/.local/share/auroravault/homes/default

If auth shows invalid, re-run vault config set-token.

Step 2

Store and verify

$ vault put example.txt $ vault verify example.txt

Vault stores encrypted data, issues a signed receipt, and verifies the local file against the receipt and Continuity ledger.

Step 3

Use a pipeline

$ cat build.log | vault put --stdin --name "build-log"

Retrieve decrypted bytes on stdout when a downstream command needs them:

$ vault get <object_id> --stdout | sha256sum

Step 4

List and retrieve

$ vault list

$ vault get <object_id> --out recovered.txt

By short index:

$ vault get 1 --out recovered.txt

Step 5

Verify a receipt

Cache the server public key once, then verify the receipt signature offline:

$ vault witness pubkey $ vault verify <receipt.witness.json> --pubkey ~/path_to_active_home/server.pub signature ✓

No server contact is required for receipt-mode verification once the public key is cached locally. File verification with vault verify <file> also checks Continuity anchoring by fetching the current ledger.

What signature ✓ means: the receipt was signed by the server's Ed25519 private key. The signature can be verified by anyone holding the public key — including you, offline, in three years, without this service running. The server cannot retroactively alter the receipt. The content commitment in the receipt binds the signature to your specific file version without revealing the plaintext hash to the server.