Clients

Node.js

@valt0/client connects to the Valt0 service and opens the vaults that have been imported into it with valt0 import.

Install it

Requires Node.js 20 or later.

$npm install @valt0/client

Open a vault

A vault is opened by its id and its name.

openVault loads a vault from the local service, the service can only open a vault that has been imported into it, so run valt0 import on the vault first.

It throws if the service cannot be reached, or if the vault cannot be loaded.

TypeScript

import { openVault } from '@valt0/client'

const vault = await openVault({
    id: 'your-vault-id',
    name: 'your-vault-name',
})

From CommonJS it is the same call, loaded with require:

CommonJS

const { openVault } = require('@valt0/client')

Read a secret

Ask for a secret by name, use it, then destroy it.

vault.secret(name) fetches one secret and resolves to a Secret. Take the value out as bytes where you can: bytes() hands back a copy you can wipe once you are done with it, and destroy() zeroes the secret’s own buffer.

If you need the secret as a string use reveal().

TypeScript

const secret = await vault.secret('DATABASE_PASSWORD')

// Preferred: raw bytes you can wipe when done
const bytes = secret.bytes()

// Or, when a string is unavoidable
await db.connect({ password: secret.reveal() })

// Zero the underlying buffer as soon as you are finished
secret.destroy()

Anywhere else, a Secret prints as [REDACTED] rather than its value: in a log line, a template string, JSON and a stack trace alike. The value comes out only where you ask for it, with reveal() or bytes().

TypeScript

console.log(secret)             // Secret([REDACTED])
console.log(`${secret}`)        // [REDACTED]
JSON.stringify({ pw: secret })  // {"pw":"[REDACTED]"}

secret.reveal()                 // the actual value

API

openVault(options): Promise<Vault>

Opens the vault in options.

Options

idstring: The vault’s id, the one valt0 info prints.
namestring: The vault’s name.

Vault

The opened vault object.

Fields

id: The vault’s id.
name: The vault’s name.

Methods

secret(name)Promise<Secret>: Fetches one secret by name.

Secret

An object representing a vault secret.

Methods

bytes(): A copy of the raw bytes. Preferable to use, if possible, because a copy can be wiped.
reveal()string: The value decoded as UTF-8 text.
destroy(): Remove the secret from memory.