Node.js client

Requires Node.js 20 or later.

A vault is opened by its id; the name is a label you choose.

openVault loads a vault from the local service. Pass it the id that valt0 info prints for the vault. The service can only open a vault that has been imported into it. A vault you create is imported for you; for one made somewhere else, run valt0 import first.

It throws if the service cannot be reached or the vault cannot be loaded.

import { openVault } from '@valt0/client'

const vault = await openVault({
    id: 'your-vault-id',
    name: 'your-vault-name',
})

From CommonJS it is the same call, loaded with require:

const { openVault } = require('@valt0/client')

Ask for a secret by name, use it, then destroy it.

vault.secret(name) fetches one secret and resolves to a Secret. Take the value out as bytes where you can: bytes() hands back a copy you can wipe once you are done with it, and destroy() zeroes the secret's own buffer.

If you need the secret as a string use reveal().

const secret = await vault.secret('DATABASE_PASSWORD')

// Preferred: raw bytes you can wipe when done
const bytes = secret.bytes()

// Or, when a string is unavoidable
await db.connect({ password: secret.reveal() })

// Zero the underlying buffer as soon as you are finished
secret.destroy()

Unless you ask for its value, a Secret prints as [REDACTED]: in a log line, a template string, JSON and a stack trace alike. The value comes out only through reveal() or bytes().

console.log(secret)             // Secret([REDACTED])
console.log(`${secret}`)        // [REDACTED]
JSON.stringify({ pw: secret })  // {"pw":"[REDACTED]"}

secret.reveal()                 // the actual value