secret() - Elding

secret() fetches the raw value of a key from the vault. It is the safety net for cases the proxy cannot (yet) route. As long as a provider works with configure(), always prefer it: with configure() the key never touches your process.

secret() does not go through the proxy. The real key enters your application’s memory (client mode) and the host-lock is not enforced. Use it only when configure() cannot do the job.

import { secret } from "@elding/sdk";

const authToken = await secret("TWILIO_AUTH_TOKEN");
const client = twilio(accountSid, authToken);

When to use it

configure() covers providers with a simple auth header (Authorization: Bearer …, x-api-key). secret() takes over for the rest:

Compound auth

Twilio (Basic base64(SID:token)) and any two-value scheme the proxy cannot assemble.

Custom header

Azure OpenAI (api-key:), Token … schemes, or any non-standard auth header.

SDK without baseURL

A client that exposes neither baseURL nor a custom fetch — impossible to route through the proxy.

One-off non-HTTP secret

A value used directly in-process, outside of an HTTP call.

The tradeoff

	`configure()` (proxy)	`secret()` (client)
Key in the process	never	yes (5 min, then wiped)
Host-lock enforced	yes	no
Providers	simple header (Bearer / x-api-key)	all (Basic, custom, non-HTTP)

You give up zero-knowledge for that key. But it still beats a .env: centralized, rotatable, encrypted at rest, audited fetch, and held in memory for 5 minutes max then wiped — instead of a .env present in the whole process for its entire lifetime.

Rule: configure() by default. secret() only when the proxy cannot inject the key.

Parameters

Parameter	Type	Required	Description
`name`	`string`	Yes	Key name in the vault (`A-Z`, `0-9`, `_`).
`options`	`ClientOptions`	No	Override `refreshToken`, `setId`, or `cacheTtlMs`.

Returns Promise<string> — the raw key value.

​When to use it

Compound auth

Custom header

SDK without baseURL

One-off non-HTTP secret

​The tradeoff

​Parameters

When to use it

The tradeoff

Parameters