Welcome to the API Vault documentation. This guide covers everything you need to know about using API Vault for secure secret management.
The API Vault SDK allows you to securely access your vault keys from JavaScript/TypeScript projects. This SDK is read-only: key creation, update, and deletion must be performed via the API Vault web platform.
✅ Supports both ES Modules and CommonJS - works in any JavaScript environment!
npm install amay-key-vault-sdk
tok_
)import KeyVault from 'amay-key-vault-sdk';
const kv = new KeyVault({
apiUrl: 'https://yourdomain.com/api',
getToken: () => 'your-api-token',
onAuthError: () => console.log('Token expired')
});
const KeyVault = require('amay-key-vault-sdk');
const kv = new KeyVault({
apiUrl: 'https://yourdomain.com/api',
getToken: () => 'your-api-token',
onAuthError: () => console.log('Token expired')
});
// Simple function to get a key by name
async function getKey(keyName, folderId) {
const { keys } = await kv.listKeys({ folderId, limit: 100 });
const key = keys.find(k => k.name === keyName);
const keyWithValue = await kv.getKey(key.id, { includeValue: true });
return keyWithValue.value;
}
// Usage
const apiKey = await getKey('key-name', 'folder-id');
// Or get all keys in a folder
const { keys } = await kv.listKeys({ folderId: 'folder-id' });
console.log('Available keys:', keys.map(k => k.name));
new KeyVault({ apiUrl, getToken, onAuthError? })
listKeys({ folderId, limit?, offset? })
{ keys, total, limit, offset }
- Array of key metadata (no values)getKey(keyId, { includeValue })
key
object with metadata and optionally the valuegetKey(keyId, { includeValue? })
key
object with metadata and optionally the valueThe SDK automatically detects your module system and provides the appropriate format. No configuration needed - it just works!
// package.json: "type": "module"
import KeyVault from 'amay-key-vault-sdk';
const kv = new KeyVault({
apiUrl: 'https://yourdomain.com/api',
getToken: () => 'your-token'
});
// package.json: no "type" field
const KeyVault = require('amay-key-vault-sdk');
const kv = new KeyVault({
apiUrl: 'https://yourdomain.com/api',
getToken: () => 'your-token'
});
// Simple function to get any key by name
async function getKey(keyName, folderId) {
const { keys } = await kv.listKeys({ folderId, limit: 100 });
const key = keys.find(k => k.name === keyName);
const keyWithValue = await kv.getKey(key.id, { includeValue: true });
return keyWithValue.value;
}
// Usage
const apiKey = await getKey('stripe-secret-key', 'your-folder-id');
const dbPassword = await getKey('database-password', 'your-folder-id');
async function getDatabaseUrl() {
try {
// First, list keys to find the one you want
const { keys } = await kv.listKeys({ folderId: 'your-folder-id' });
// Find the key by name
const dbUrlKey = keys.find(key => key.name === 'DB_URL');
if (dbUrlKey) {
// Get the actual value
const keyWithValue = await kv.getKey(dbUrlKey.id, { includeValue: true });
console.log('Database URL retrieved successfully');
return keyWithValue.value;
} else {
throw new Error('DB_URL key not found');
}
} catch (error) {
console.error('Error fetching database URL:', error);
throw error;
}
}
// Use it
const databaseUrl = await getDatabaseUrl();
const { Pool } = require('pg');
const pool = new Pool({ connectionString: databaseUrl });
const environment = process.env.NODE_ENV || 'development';
const folderId = environment === 'production' ? 'prod-folder' : 'dev-folder';
const secrets = {
database: await kv.getKeyValue(folderId, 'DB_URL'),
apiKey: await kv.getKeyValue(folderId, 'API_KEY'),
jwtSecret: await kv.getKeyValue(folderId, 'JWT_SECRET')
};
try {
const secret = await kv.getKeyValue('folder-id', 'DB_URL');
// Use secret
} catch (error) {
if (error.message.includes('not found')) {
console.error('DB_URL not found');
} else if (error.message.includes('Unauthorized')) {
console.error('Invalid API token');
} else {
console.error('Failed to retrieve DB_URL:', error.message);
}
}
The API Vault Python SDK allows you to securely access your vault keys from Python applications. This SDK is read-only: key creation, update, and deletion must be performed via the API Vault web platform.
✅ Latest Version: v1.0.1 - Fixed URL construction bug for improved reliability.
pip install amay-key-vault-sdk
from key_vault_sdk import KeyVault
# Initialize the SDK
kv = KeyVault(
api_url="https://yourdomain.com/api",
token="your-api-token-here"
)
# Get a specific secret value by name
secret_value = kv.get_key_by_name("folder-id", "DB_URL")
print("Secret retrieved successfully")
# Or get all keys in a folder
result = kv.list_keys(folder_id="folder-id")
print("Available keys:", [k['name'] for k in result['keys']])
KeyVault(api_url, token, timeout=30)
list_keys(folder_id, limit=20, offset=0)
dict
- Dictionary with keys list and pagination infoget_key(key_id, include_value=False)
dict
- Key object with metadata and optionally the valueget_key_by_name(folder_id, key_name)
str
- The decrypted secret valuefrom key_vault_sdk import KeyVault
# Initialize
kv = KeyVault(
api_url="https://yourdomain.com/api",
token="your-api-token"
)
# Get a key by name
api_key = kv.get_key_by_name("folder-id", "key-name")
print(f"API Key: {api_key}")
# Get multiple keys
keys = kv.get_multiple_keys(
folder_id="folder-id",
key_names=["stripe-key", "database-password"]
)
print(f"Retrieved keys: {keys}")
from key_vault_sdk import KeyVault, KeyVaultError, KeyVaultAuthError, KeyVaultNotFoundError
try:
secret = kv.get_key_by_name("folder-id", "secret-name")
# Use secret
except KeyVaultNotFoundError:
print("Secret not found")
except KeyVaultAuthError:
print("Invalid API token")
except KeyVaultError as e:
print(f"Failed to retrieve secret: {e}")
The Key Vault REST API provides full programmatic access to your secrets. All endpoints require authentication.
https://yourdomain.com/api
All API requests require authentication via:
Authorization: Bearer <token>
)If you prefer to use direct API calls instead of the SDK:
import fetch from 'node-fetch';
const BASE_URL = 'https://yourdomain.com';
const API_TOKEN = 'tok_your-api-token-here';
async function getDatabaseUrl() {
try {
// 1. List folders to get folder ID
const foldersResponse = await fetch(`${BASE_URL}/api/folders`, {
headers: {
'Authorization': `Bearer ${API_TOKEN}`,
'Content-Type': 'application/json'
}
});
const foldersData = await foldersResponse.json();
const folderId = foldersData.folders[0].id;
// 2. List keys in the folder
const keysResponse = await fetch(`${BASE_URL}/api/keys?folderId=${folderId}`, {
headers: {
'Authorization': `Bearer ${API_TOKEN}`,
'Content-Type': 'application/json'
}
});
const keysData = await keysResponse.json();
// 3. Find the DB_URL key
const dbUrlKey = keysData.keys.find(key => key.name === 'DB_URL');
if (dbUrlKey) {
// 4. Get the actual value
const keyValueResponse = await fetch(`${BASE_URL}/api/keys/${dbUrlKey.id}?includeValue=true`, {
headers: {
'Authorization': `Bearer ${API_TOKEN}`,
'Content-Type': 'application/json'
}
});
const keyValueData = await keyValueResponse.json();
console.log('Database URL retrieved successfully');
return keyValueData.key.value;
}
} catch (error) {
console.error('Error:', error);
throw error;
}
}
// Use it
const databaseUrl = await getDatabaseUrl();
POST /api/keys
Content-Type: application/json
{
"name": "Database Password",
"value": "secret-password",
"type": "PASSWORD",
"folderId": "folder-id",
"description": "Production database password"
}
GET /api/keys?folderId=folder-id
GET /api/keys/{keyId}?includeValue=true
PUT /api/keys/{keyId}
Content-Type: application/json
{
"name": "Updated Name",
"value": "new-secret-value"
}
DELETE /api/keys/{keyId}
POST /api/folders
Content-Type: application/json
{
"name": "Production",
"description": "Production environment secrets",
"color": "#ff0000"
}
GET /api/folders
Log in to the Key Vault web platform and navigate to the "API" page to copy your API token.
No, the SDK is read-only for security. Use the web platform or REST API for key management.
You'll see warnings in the UI and API calls will be rejected. Upgrade your plan to continue.
Yes! You can view and contribute to the SDK on our GitHub repository.
We use AES-256-GCM encryption with unique salts and IVs for each secret. The encryption key is stored securely and never exposed.
Yes! The SDK supports both ES Modules and CommonJS. It automatically detects your module system and provides the appropriate format.
Yes, the SDK works in both Node.js and browser environments.
Need help? Check out our GitHub repository for issues and feature requests, or contact us through the support channels available in your plan.
MIT License - see LICENSE file for details.