diff --git a/castellan/key_manager/vault_key_manager.py b/castellan/key_manager/vault_key_manager.py
index ad1424f..8d9a895 100644
--- a/castellan/key_manager/vault_key_manager.py
+++ b/castellan/key_manager/vault_key_manager.py
@@ -173,10 +173,14 @@
             if resp.status_code == requests.codes['forbidden']:
                 raise exception.Forbidden()
 
-            resp = resp.json()
-            self._cached_approle_token_id = resp['auth']['client_token']
+            resp_data = resp.json()
+
+            if resp.status_code == requests.codes['bad_request']:
+                raise exception.KeyManagerError(', '.join(resp_data['errors']))
+
+            self._cached_approle_token_id = resp_data['auth']['client_token']
             self._approle_token_issue = token_issue_utc
-            self._approle_token_ttl = resp['auth']['lease_duration']
+            self._approle_token_ttl = resp_data['auth']['lease_duration']
             return {'X-Vault-Token': self._approle_token_id}
 
         return {}