Use these pages after Get started when your platform needs more than the default path: a different JWT key source, certificate auth, a tighter policy, or metrics and dashboards.
For every configuration field and its default, see Configuration .
Pages in this section
Variants of the default OpenBao setup: manual or OpenTofu setup, policy details and capabilities to avoid, host JWT agent requirements, JWKS or pinned JWT keys, and certificate auth with PKCS#11.
→ Configure · Authentication OAuth 2.0 client credentialsObtain JWT access tokens directly from an independent OAuth authorization server and exchange them for OpenBao tokens.
→ Configure · Authentication Provision a Keycloak clientProvision an independent Keycloak service account, bind its identity in OpenBao, and install its client secret on provider hosts.
→ Configure · Observability Monitor the providerScrape provider metrics on every control-plane node, load the sample alert rules, and import the Grafana dashboard.
→