# How to change token of harshicop vault

**URL:** <https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440>\
**Category:** PG\_TDE – Transparent Data Encryption (TDE)\
**Created:** [October 18, 2024, 7:05am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440 "2024-10-18T07:05:16Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![cuongtm](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@cuongtm](https://forums.percona.com/u/cuongtm)\
**Post date:** [October 18, 2024, 7:05am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/1 "2024-10-18T07:05:16Z")

</div>

Hi,

we are using vault for pg\_tde, we already add vault\_v2 and set principle key, but now we want to change vault token, how to do that

SELECT pg\_tde\_add\_key\_provider\_vault\_v2(‘provider-name’, **:‘secret\_token’** ,‘url’,‘mount’,‘ca\_path’);

---

<div class="post-metadata">

**Author:** ![Jan\_Wieremjewicz](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jan_wieremjewicz/32/7324_2.png) [@Jan\_Wieremjewicz](https://forums.percona.com/u/Jan_Wieremjewicz)\
**Post date:** [October 21, 2024, 7:14am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/2 "2024-10-21T07:14:06Z")

</div>

Hi! Thanks for reaching out!

For now, the way to do it is to add a new provider and change the principal key to the new provider as we have not add yet functions to modify/delete a provider. These are already planned, just the priority now is with hardening and use cases that have no workarounds.

Can you share some more about the use case where you tested pg\_tde? Is this workaround I presented something that can get you through your issue?

---

<div class="post-metadata">

**Author:** ![cuongtm](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@cuongtm](https://forums.percona.com/u/cuongtm)\
**Post date:** [October 21, 2024, 7:33am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/3 "2024-10-21T07:33:15Z")

</div>

because our vault token was expired so that DB cannot get master key from vault. From vault site they already recreate token but we can not update from DB site, when token expired, i cannot do anything for add new provider or change principle key

---

<div class="post-metadata">

**Author:** ![cuongtm](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@cuongtm](https://forums.percona.com/u/cuongtm)\
**Post date:** [October 21, 2024, 7:40am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/4 "2024-10-21T07:40:01Z")

</div>

is there any way to backup and restore principle key, incase there is some issue with provider?

---

<div class="post-metadata">

**Author:** ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)\
**Post date:** [October 22, 2024, 12:41pm UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/5 "2024-10-22T12:41:32Z")

</div>

Hello!

We have no interface for this at the moment, we’ll add it in the future. In the meantime, you can try editing the datafile for pg\_tde manually (make sure that the server is stopped during this, and make a backup of the file before).

The data file is in the data directory, with a path /base/\<database\_oid\>/pg\_tde\_keyrings

---

<div class="post-metadata">

**Author:** ![cuongtm](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@cuongtm](https://forums.percona.com/u/cuongtm)\
**Post date:** [October 25, 2024, 6:36am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/6 "2024-10-25T06:36:34Z")

</div>

Hi, /base/\<database\_oid\>/pg\_tde\_keyrings is binary file, how can i edit and replace new token?

---

<div class="post-metadata">

**Author:** ![cuongtm](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@cuongtm](https://forums.percona.com/u/cuongtm)\
**Post date:** [October 25, 2024, 7:01am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/7 "2024-10-25T07:01:08Z")

</div>

try to edit with vi, when restart db and select encrypted table, the error:

ERROR: key provider info file is corrupted: No such file or directory  
DETAIL: invalid key provider record size 1 expected 1160

---

<div class="post-metadata">

**Author:** ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)\
**Post date:** [October 25, 2024, 7:19am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/8 "2024-10-25T07:19:01Z")

</div>

Hello

Yes, it’s binary. You can use vim in hex/binary mode, for example:

```auto
vim -b <filename>
:%!xxd
:%!xxd -r (to save it)

```

but this als depends on your vimrc/configuration.

Or you can edit the file with a command line hex/binary editor, there are many available.

---

<div class="post-metadata">

**Author:** ![cuongtm](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@cuongtm](https://forums.percona.com/u/cuongtm)\
**Post date:** [October 25, 2024, 7:34am UTC](https://forums.percona.com/t/how-to-change-token-of-harshicop-vault/34440/9 "2024-10-25T07:34:41Z")

</div>

i already edit new token, but still error, is there any DB checksum info that check to make sure no manual edit?

ERROR: key provider info file is corrupted: No such file or directory  
DETAIL: invalid key provider record size 1 expected 1160