> ## Documentation Index
> Fetch the complete documentation index at: https://docs.elding.app/llms.txt
> Use this file to discover all available pages before exploring further.

# secret()

> The fallback for when the proxy cannot inject the key — the raw value, as a last resort.

`secret()` fetches the **raw value** of a key from the vault. It is the **safety net** for cases the proxy cannot (yet) route. As long as a provider works with [`configure()`](/en/sdk/configure), always prefer it: with `configure()` the key never touches your process.

<Warning>
  `secret()` **does not go through the proxy**. The real key enters your application's memory (client mode) and the host-lock is **not enforced**. Use it only when `configure()` cannot do the job.
</Warning>

```js theme={null}
import { secret } from "@elding/sdk";

const authToken = await secret("TWILIO_AUTH_TOKEN");
const client = twilio(accountSid, authToken);
```

***

## When to use it

`configure()` covers providers with a simple auth header (`Authorization: Bearer …`, `x-api-key`). `secret()` takes over for the rest:

<CardGroup cols={2}>
  <Card title="Compound auth" icon="key">
    Twilio (`Basic base64(SID:token)`) and any two-value scheme the proxy cannot assemble.
  </Card>

  <Card title="Custom header" icon="code">
    Azure OpenAI (`api-key:`), `Token …` schemes, or any non-standard auth header.
  </Card>

  <Card title="SDK without baseURL" icon="plug">
    A client that exposes neither `baseURL` nor a custom `fetch` — impossible to route through the proxy.
  </Card>

  <Card title="One-off non-HTTP secret" icon="lock">
    A value used directly in-process, outside of an HTTP call.
  </Card>
</CardGroup>

***

## The tradeoff

|                    | [`configure()`](/en/sdk/configure) (proxy) | `secret()` (client)               |
| ------------------ | ------------------------------------------ | --------------------------------- |
| Key in the process | never                                      | yes (5 min, then wiped)           |
| Host-lock enforced | yes                                        | no                                |
| Providers          | simple header (Bearer / x-api-key)         | **all** (Basic, custom, non-HTTP) |

You give up zero-knowledge for that key. But it still beats a `.env`: centralized, **rotatable**, encrypted at rest, **audited fetch**, and held in memory for **5 minutes max** then wiped — instead of a `.env` present in the whole process for its entire lifetime.

<Note>
  Rule: [`configure()`](/en/sdk/configure) by default. `secret()` only when the proxy cannot inject the key.
</Note>

***

## Parameters

| Parameter | Type            | Required | Description                                        |
| --------- | --------------- | -------- | -------------------------------------------------- |
| `name`    | `string`        | Yes      | Key name in the vault (`A-Z`, `0-9`, `_`).         |
| `options` | `ClientOptions` | No       | Override `refreshToken`, `setId`, or `cacheTtlMs`. |

Returns `Promise<string>` — the raw key value.