Vault Enterprise doesn't bill tokens. It bills clients.
That distinction is why some teams see client counts explode without understanding why.
@HashiCorp
Get it one way, and one workload becomes 100 clients. Get it another way, and 100 workloads collapse to one.
This isn't theoretical—it's deterministic behavior.
I broke this down with controlled testing, not documentation.
How Vault Enterprise actually counts clients: myros.net/how-vault-enterpri…
Vault Enterprise bills clients, not tokens.
But how it derives "client identity" can quietly explode your bill — or hide massive usage. I tested this rigorously on 1.21.1. Here's the real picture
Full deep-dive (methodology, tables, remediation, audit queries, sudo collapse example): myros.net/how-vault-enterpri…
Live discussion thread: discuss.hashicorp.com/t/how-…
#Vault #HashiCorp #DevOps
Non-entity tokens (direct create, orphans, token auth) → identity = namespace + sorted policy names → unique combinations = separate clients
Even with 1.9+ deduplication, policy sprawl = combinatorial nightmare.
Worst trap: orphans never inherit entity_id — ever.
Entity-backed auth (LDAP, OIDC, userpass, AppRole+aliases) → anchors to entity_id → all tokens + children = 1 client Stable. Predictable. The right way.
Keen: Responsive Bootstrap Admin & Dashboard Template... #bootstrap #bootstrap4 #html5 keenthemes.com/keen via @keenthemes
Metronic: Ultimate Bootstrap 4 Admin Theme Used By 60,000 ... #bootstrap, #themeforest themeforest.net/item/metroni… via @keenthemes