At the moment secrets_provider_vault requires a token for creation. The module has the capability to pass in client_cert and client_key for tls, but doesn't allow for authentication with this method, as it requires a token, and even providing an empty token will not allow this to fall back on certificate auth.