Bao GUI is a lightweight desktop client for OpenBao, the Vault-compatible secrets manager I run on my own platform. It talks to the REST API through the official Go SDK, needs no server-side changes, and puts the everyday jobs of a secrets administrator in one native window: browsing and editing KV v2 secrets, issuing and revoking tokens, and using transit keys.
AI contribution: AI-assisted implementation and integration tests. How I work with AI
Secret rotation, version restores and token audits are the tasks you do rarely and must get right. A window that shows the version history and asks before a hard delete beats remembering flags.
Breadcrumb folders, filter box, back and forward history. Create, read, edit and rename; version history with restore, delete and undelete per version; soft-delete the latest or hard-delete all. Folders are a KV convention, so an empty folder is kept visible with a hidden placeholder entry.
Log in with userpass or an existing token, create tokens with policies, TTL and metadata, list active tokens by accessor, look up, renew and revoke.
Create and delete transit keys (AES-GCM, ChaCha20-Poly1305, ECDSA, Ed25519, RSA), inspect key info, and encrypt or decrypt with the selected key from the window.
Named connection profiles with a configurable KV mount and an insecure-TLS toggle for self-signed certificates on private networks. The active profile reconnects on launch; the token lives in the OS keyring.
Store a profile's password once in the macOS Keychain behind a system authentication prompt; afterwards a fingerprint fills it in. The page says plainly that an ad-hoc-signed binary gates the credential with Touch ID but cannot bind it to the Secure Enclave.
⌘1–4 switch tabs, ⌘L focuses the server address, ⌘Return connects, ⌘[ and ⌘] walk folder history, ⌘F filters secrets.
A GUI for a secrets manager is only trustworthy if its destructive paths are exercised. The live suite drives the real window through the connection bar, the secret editor and the folder menu against a real instance.
A small wrapper around the OpenBao Go SDK handles auth, KV, tokens and transit, so the UI never builds API paths by hand.
internal/client/ auth, KV v2, tokens, transit
The mock OpenBao API means tests need no server, no keychain writes and no network, and they run in the GitLab pipeline on every push.
go vet ./... && go test ./...
Two suites hit a real instance with throwaway resources and guarantee zero leftovers, including on failure. The GitLab job is manual and reads masked CI variables.
go test -tags integration -run TestQALiveConnection ./internal/gui/
A packaging script builds the ad-hoc-signed app bundle, verifies the signature, and produces a DMG; a release script tags the repository and attaches the DMG to a GitLab release.
packaging/package.sh && packaging/release.sh vX.Y
The admin token gives full control of the vault, and the app stores it locally on purpose, so it belongs on machines you trust. The insecure-TLS toggle skips certificate verification and is meant for private networks with self-signed certificates, not the public internet. Touch ID gates the saved credential; without a Developer ID signature it cannot be bound to the Secure Enclave, and the README says so.
The repository is private on my GitLab. If you'd like a walkthrough or want to talk secrets management on small teams, email me.