> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://platform.bctrl.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://platform.bctrl.ai/_mcp/server.

# Read secret value

> Read one authorized Vault secret value.

Read one Vault secret when the caller and Space policy allow raw reads. This
Tool returns sensitive data; keep the result in memory only as long as needed
and never log it.

## Read a secret

```ts
const secret = await bctrl.tools.call("vault.secrets.value", {
  name: "production/github/login",
});

if (secret.type === "login") {
  console.log(secret.username); // do not log credentials in production
} else {
  console.log(secret.value); // do not log secret values in production
}
```

## Request parameters

| Parameter | Type              | Required | Description     |
| --------- | ----------------- | -------- | --------------- |
| `name`    | `VaultSecretName` | Yes      | Secret to read. |

## Response

The result is a discriminated union based on `type`:

| `type`  | Fields                                 |
| ------- | -------------------------------------- |
| `login` | `name`, `type`, `username`, `password` |
| `value` | `name`, `type`, `value`                |

This Tool does not return `totpSecret`. Use [Generate TOTP](/sdk/tools/vault/vault-totp-generate)
for the current one-time code. Raw reads are controlled by the Space Vault
policy; see [Spaces](/sdk/spaces).

## Next

* [Get secret metadata](/sdk/tools/vault/vault-secrets-get) — inspect without reading values
* [Generate TOTP](/sdk/tools/vault/vault-totp-generate) — create a current code
* [Spaces](/sdk/spaces) — configure raw-read access