Vault AppRole "failed to get credentials" (role_id/secret_id) in CI

By Daniel Zoghalchali·Latchkey

The AppRole login inputs arrived empty. In CI this is usually an unset or misnamed secret: the roleId/secretId (or VAULT_ROLE_ID/VAULT_SECRET_ID) resolved to a blank string, so Vault has no credentials to check.

What this error means

hashicorp/vault-action or a login script fails with "failed to get credentials" or "invalid role or secret id" because the injected values are empty.

Error: failed to retrieve secrets from Vault. failed to get credentials.
respond with error message: invalid role or secret id

Common causes

The secret is unset or misnamed

A typo like secrets.VAULT_ROLEID (missing underscore) resolves to empty, so an empty role_id is sent.

Secrets are unavailable to the step

On a fork PR or an environment without the secret, GitHub passes an empty value, and the login has nothing to authenticate with.

How to fix it

Wire the secrets with the exact names

1. Store VAULT_ROLE_ID and VAULT_SECRET_ID as repository or environment secrets.
2. Reference them with the precise secrets.<NAME> expression.
3. Fail early if either is empty.

- uses: hashicorp/vault-action@v3
  with:
    url: ${{ secrets.VAULT_ADDR }}
    method: approle
    roleId: ${{ secrets.VAULT_ROLE_ID }}
    secretId: ${{ secrets.VAULT_SECRET_ID }}
    secrets: secret/data/ci/app apiKey | API_KEY

Guard against empty credentials

Assert the values are present before login so the failure is obvious.

test -n "$VAULT_ROLE_ID" || { echo "VAULT_ROLE_ID empty"; exit 1; }
test -n "$VAULT_SECRET_ID" || { echo "VAULT_SECRET_ID empty"; exit 1; }

How to prevent it

• Reference secret names exactly; a typo yields a silent empty value.
• Assert credentials are non-empty before attempting login.
• Remember fork PRs do not receive repository secrets.

Frequently asked questions

Related guides

References

• GitHub Actions documentation