Use Vault response wrapping on a cubbyhole path to deliver a one-time-use secret to a consumer without storing it in a shared location

Steps

1. The producer authenticates to Vault and writes a secret to the cubbyhole with response wrapping: 'VAULT_TOKEN=<PRODUCER_TOKEN> vault kv put -wrap-ttl=300s cubbyhole/handoff api_key=<VALUE>'
2. Vault returns a wrapping token instead of the write confirmation; the wrapping token is the only way to retrieve the cubbyhole value
3. Deliver the wrapping token to the consumer via a secure side channel (e.g., instance metadata, encrypted message queue)
4. The consumer unwraps the token: 'vault unwrap <WRAPPING_TOKEN>' which reveals the original write response containing the cubbyhole path data
5. After unwrapping, the wrapping token is destroyed; any second attempt to unwrap returns a 400 error
6. Use 'vault token lookup <WRAPPING_TOKEN>' before handing off to verify the TTL has not expired; never share the wrapping token over an unencrypted channel