Home

node-vault-client

A HashiCorp Vault client for Node.js that is opinionated about the boring parts: it authenticates, keeps the token alive, figures out whether a mount is KV v1 or v2, and hands you the secret.

npm install node-vault-client

const VaultClient = require('node-vault-client');

const vault = VaultClient.boot('main', {
    api:  { url: 'https://vault.example.com:8200/' },
    auth: { type: 'kubernetes', config: { role: 'my-app' } },
});

const lease = await vault.read('secret/app');
console.log(lease.getValue('DB_PASSWORD'));

That is the whole integration. There is no login call, no token renewal timer, no secret/data/... vs secret/... path juggling, and no lease bookkeeping in your code.

Start here

Page	What's in it
Getting Started	Install, requirements, configuring each auth backend, first read
Recipes & Use Cases	Twelve worked examples: app config at boot, Kubernetes, AWS IAM, KV v2, namespaces, rotation, testing, shutdown
Why this client	How it compares to the other Node Vault clients, and when to pick something else

What it does for you

• Four auth backends — Token, AppRole, AWS IAM, Kubernetes — behind one interface, so switching from local dev (token) to production (kubernetes / iam) is a config change.
• Automatic token lifecycle. Login happens on first use, the token is renewed in the background, and concurrent callers share a single in-flight login instead of stampeding the auth endpoint.
• KV v1 and KV v2 without path rewriting. vault.read('secret/app') works on either; the client resolves the mount version and builds secret/data/app when it needs to.
• Vault Enterprise namespaces, applied to every request — login, token lookup and renewal included.
• A typed error hierarchy, so err instanceof VaultHttpError and err.statusCode === 403 beat string-matching.
• Direct node-config integration — put vault:secret/app#DB_PASSWORD in your config file and call fillNodeConfig().

Project

• Source: namecheap/node-vault-client · npm: node-vault-client
• Node 18+ (CI runs the suite on 18, 20, 22 and 24)
• Apache-2.0, published to npm with provenance attestation
• Contributing · Security policy