Read secret value

Read one Vault secret when the caller and Space policy allow raw reads. This Tool returns sensitive data; keep the result in memory only as long as needed and never log it.

Read a secret

1
const secret = await bctrl.tools.call("vault.secrets.value", {
2
  name: "production/github/login",
3
});
4
5
if (secret.type === "login") {
6
  console.log(secret.username); // do not log credentials in production
7
} else {
8
  console.log(secret.value); // do not log secret values in production
9
}

Request parameters

Response

The result is a discriminated union based on type:

This Tool does not return totpSecret. Use Generate TOTP for the current one-time code. Raw reads are controlled by the Space Vault policy; see Spaces.

Next

• Get secret metadata — inspect without reading values
• Generate TOTP — create a current code
• Spaces — configure raw-read access