Security & Quality

HashiCorp Vault Secrets

Manage secrets, encryption keys, and certificates securely with HashiCorp Vault for production environments.

Claude Code Cursor Copilot

Overview

HashiCorp Vault is an identity-based secrets management system that provides secure storage, dynamic secrets generation, data encryption, and certificate management. It centralizes secret management across infrastructure, providing a single source of truth for API keys, database credentials, encryption keys, and certificates.

Vault supports multiple secret engines including key/value stores, dynamic database credentials, PKI certificate generation, and cloud provider credentials (AWS, GCP, Azure). Dynamic secrets are generated on-demand with automatic expiration and revocation, eliminating the risk of long-lived static credentials. Vault also provides encryption as a service through its Transit engine, allowing applications to encrypt data without managing encryption keys directly.

For Node.js applications, the node-vault library provides a client for interacting with Vault's HTTP API. Authentication methods include tokens, AppRole (for applications), Kubernetes (for containerized apps), and cloud IAM. Vault's audit logging tracks every secret access and operation, providing a complete audit trail for compliance requirements.

Who Is This For?

Store and retrieve application secrets from Vault
Generate dynamic database credentials per deployment
Encrypt sensitive data using Vault Transit engine
Manage TLS certificates with automatic rotation

Installation

Setup for Claude Code

npm install node-vault

Configuration

import vault from "node-vault"

const client = vault({
  apiVersion: "v1",
  endpoint: "https://vault.mycompany.com:8200",
  token: process.env.VAULT_TOKEN,
})

// Read a secret
const { data } = await client.read("secret/data/myapp")
const dbPassword = data.data.db_password