Go client

Requires Go 1.26 or later.

A vault is opened by its id; the name is a label you choose.

valt0.OpenVault loads a vault from the local service. Pass it the id that valt0 info prints for the vault. The service can only open a vault that has been imported into it. A vault you create is imported for you; for one made somewhere else, run valt0 import first.

It returns an error if the service cannot be reached or the vault cannot be loaded.

import "go.valt0.com/valt0"

vault, err := valt0.OpenVault(valt0.VaultOptions{
    Id:   "your-vault-id",
    Name: "your-vault-name",
})
if err != nil {
    log.Fatal(err)
}

Ask for a secret by name, use it, then destroy it.

vault.Secret(name) fetches one secret and returns a *Secret. Take the value out as bytes where you can: Bytes() hands back the secret's own buffer, and Destroy() zeroes it, so defer Destroy() as soon as you have the secret.

If you need the secret as a string use Reveal().

secret, err := vault.Secret("DATABASE_PASSWORD")
if err != nil {
    log.Fatal(err)
}
// Zero the underlying buffer as soon as you are finished
defer secret.Destroy()

// Preferred: raw bytes, wiped by Destroy()
pw := secret.Bytes()

// Or, when a string is unavoidable
db.Connect(secret.Reveal())

Unless you ask for its value, a Secret prints as [REDACTED]. It implements fmt.Stringer, fmt.GoStringer, json.Marshaler, encoding.TextMarshaler and slog.LogValuer, so a fmt call, a JSON or text payload and a log line all get the redacted form. The value comes out only through Reveal() or Bytes().

fmt.Println(secret)                         // [REDACTED]
fmt.Printf("%#v\n", secret)                 // [REDACTED]
json.Marshal(map[string]any{"pw": secret})  // {"pw":"[REDACTED]"}
slog.Info("connecting", "pw", secret)       // ... pw=[REDACTED]

secret.Reveal()                             // the actual value

The two ways a connection fails have errors of their own.

OpenVault returns valt0.ErrCantConnectToService when it cannot find the service, which usually means the service is not running: valt0 status tells you whether it is. It returns valt0.ErrNoServiceResponse when the service did not answer within the one second the client waits.

Check for either with errors.Is. Any other error, such as a vault that could not be loaded, comes back as it is.

vault, err := valt0.OpenVault(opts)
switch {
case errors.Is(err, valt0.ErrCantConnectToService):
    // the service was not found: is it running?
case errors.Is(err, valt0.ErrNoServiceResponse):
    // the service did not answer within the transport timeout (1s)
case err != nil:
    // any other error, e.g. the vault could not be loaded
}