diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java
index 89179c46..c6d08886 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java
@@ -37,9 +37,11 @@ import org.springframework.web.client.RestOperations;
  * @see RestOperations
  * @see <a href="https://www.vaultproject.io/docs/auth/app-id.html">Auth Backend: App
  * ID</a>
+ * @deprecated since 2.2. Use {@link AppRoleAuthentication}.
  */
-public class AppIdAuthentication implements ClientAuthentication,
-		AuthenticationStepsFactory {
+@Deprecated
+public class AppIdAuthentication
+		implements ClientAuthentication, AuthenticationStepsFactory {
 
 	private static final Log logger = LogFactory.getLog(AppIdAuthentication.class);
 
@@ -77,9 +79,9 @@ public class AppIdAuthentication implements ClientAuthentication,
 
 		Assert.notNull(options, "AppIdAuthenticationOptions must not be null");
 
-		return AuthenticationSteps.fromSupplier(
-				() -> getAppIdLogin(options.getAppId(), options.getUserIdMechanism()
-						.createUserId())) //
+		return AuthenticationSteps
+				.fromSupplier(() -> getAppIdLogin(options.getAppId(),
+						options.getUserIdMechanism().createUserId())) //
 				.login("auth/{mount}/login", options.getPath());
 	}
 
@@ -95,8 +97,8 @@ public class AppIdAuthentication implements ClientAuthentication,
 
 	private VaultToken createTokenUsingAppId() {
 
-		Map<String, String> login = getAppIdLogin(options.getAppId(), options
-				.getUserIdMechanism().createUserId());
+		Map<String, String> login = getAppIdLogin(options.getAppId(),
+				options.getUserIdMechanism().createUserId());
 
 		try {
 			VaultResponse response = restOperations.postForObject("auth/{mount}/login",
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthenticationOptions.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthenticationOptions.java
index 4532077e..8e6c6cfc 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthenticationOptions.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthenticationOptions.java
@@ -28,7 +28,9 @@ import org.springframework.util.Assert;
  * @see AppIdAuthentication
  * @see AppIdUserIdMechanism
  * @see #builder()
+ * @deprecated since 2.2. Use {@link AppRoleAuthentication}.
  */
+@Deprecated
 public class AppIdAuthenticationOptions {
 
 	public static final String DEFAULT_APPID_AUTHENTICATION_PATH = "app-id";
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdUserIdMechanism.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdUserIdMechanism.java
index e72db9d1..0d427214 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdUserIdMechanism.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdUserIdMechanism.java
@@ -22,7 +22,9 @@ package org.springframework.vault.authentication;
  *
  * @author Mark Paluch
  * @see AppIdAuthentication
+ * @deprecated since 2.2. Use {@link AppRoleAuthentication}.
  */
+@Deprecated
 @FunctionalInterface
 public interface AppIdUserIdMechanism {
 
diff --git a/src/main/asciidoc/new-features.adoc b/src/main/asciidoc/new-features.adoc
index a00c2169..95da39f3 100644
--- a/src/main/asciidoc/new-features.adoc
+++ b/src/main/asciidoc/new-features.adoc
@@ -3,10 +3,12 @@
 
 [[new-features.2-2-0]]
 === What's new in Spring Vault 2.2
+
 * Support for Key-Value v2 (versioned backend) secrets through `@VaultPropertySource`.
 * SpEL support in `@Secret`.
 * Add support for Jetty as reactive HttpClient.
 * `LifecycleAwareSessionManager` and `ReactiveLifecycleAwareSessionManager` emit now ``AuthenticationEvent``s.
+* Deprecation of `AppIdAuthentication`. Use `AppRoleAuthentication` instead as recommended by HashiCorp Vault.
 
 [[new-features.2-1-0]]
 === What's new in Spring Vault 2.1
diff --git a/src/main/asciidoc/reference/authentication.adoc b/src/main/asciidoc/reference/authentication.adoc
index e9fb3c9f..abaac6d9 100644
--- a/src/main/asciidoc/reference/authentication.adoc
+++ b/src/main/asciidoc/reference/authentication.adoc
@@ -83,6 +83,8 @@ See also:
 [[vault.authentication.appid]]
 == AppId authentication
 
+NOTE: AppId authentication is deprecated by Vault. Use <<vault.authentication.approle>> instead.
+
 Vault supports https://www.vaultproject.io/docs/auth/app-id.html[AppId]
 authentication that consists of two hard to guess tokens. The AppId
 defaults to `spring.application.name` that is statically configured.