Vault Enterprise doesn't bill tokens. It bills clients.
That distinction is why some teams see client counts explode without understanding why.
@HashiCorp
@HashiCorp Get it one way, and one workload becomes 100 clients. Get it another way, and 100 workloads collapse to one.
This isn't theoreticalโit's deterministic behavior.
Vault Enterprise bills clients, not tokens.
But how it derives "client identity" can quietly explode your bill โ or hide massive usage. I tested this rigorously on 1.21.1. Here's the real picture
Entity-backed auth (LDAP, OIDC, userpass, AppRole+aliases) โ anchors to entity_id โ all tokens + children = 1 client Stable. Predictable. The right way.