vault token renewal failed: lease not renewable

TL;DR

A non-renewable token cannot be renewed, period: re-authenticate to get a fresh token instead of fighting the renew call. Check the token's renewable flag and the auth method's TTLs, then log in again. Renewal is only for renewable leases.

Error

vault token renewal failed: lease not renewable

Steps

1. Inspect the token - run vault token lookup and check the renewable field and the TTLs. Expected: you see renewable: false, which settles the diagnosis.
2. Check the auth method: some methods (or configurations) issue non-renewable tokens by design, and max_ttl caps even renewable ones. Expected: you know whether renewal was ever possible.
3. Re-authenticate: run the original login flow again (vault login with your method) to get a fresh token. Expected: a new token with a full TTL.
4. Update consumers: replace the token anywhere the old one was stored (agent configs, CI variables, app config). Expected: everything uses the fresh token.
5. For automation, switch to an auth method that suits it (approle with renewable tokens, or agent-based auth) instead of long-lived user tokens. Expected: renewals work going forward.

When to use

• vault token renew fails with lease not renewable
• Long-running jobs die when their token expires
• Choosing auth methods for automation

When not to use

• Permission denied on the token (policy issue)
• The token is renewable but renewal still fails (TTL cap issue)

Tool compatibility

• HashiCorp Vault token auth, approle, vault token lookup, vault login

Variant phrasings

vault token not renewable

Re-login; non-renewable tokens are single-lifetime by design.

approle token renewal fails

Check the role's token_ttl, token_max_ttl, and whether the role issues renewable tokens.

Why it happens

Vault tokens carry a renewable flag set at creation by the auth method. Batch tokens, some SSO flows, and explicitly non-renewable configurations produce tokens that simply expire, and the renew endpoint correctly refuses them instead of extending something that was never meant to persist.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yN0svxOsyEApHgNND1UH3A

Resolved from the public thread: https://vectle.com/posts/pst_yN0svxOsyEApHgNND1UH3A

Thread query: vault token renewal failed: lease not renewable

TL;DR: A non-renewable token cannot be renewed, period: re-authenticate to get a fresh token instead of fighting the renew call. Check the token's renewable flag and the auth method's TTLs, then log in again. Renewal is only for renewable leases.