@airctrl/sdk

Typed client for AIRCTRL with client-side, zero-knowledge secret decryption. Ciphertext and wrapped keys come from the API; decryption happens in your process using your vault passphrase — the server never sees plaintext. The AIRCTRL crypto engine is bundled in, so there's nothing else to install.

Install

npm install @airctrl/sdk

Before you start (get these three)

1. Personal Access Token (PAT) — in the AIRCTRL app: Settings → Developer → Create token. Copy the sk-actrl-pat-… (shown once). This is the auth value below.
2. API base URL — your AIRCTRL API (http://localhost:54330 for local dev, or your dev/prod URL).
3. Vault passphrase — the passphrase you set to unlock your vault. It's passed as vaultPassword and decrypts secrets on your machine. It is not the PAT: the PAT authenticates to the API; the passphrase decrypts the ciphertext locally.

Usage (user mode)

import { createClient } from '@airctrl/sdk'

const airctrl = createClient({
  baseUrl: process.env.AC_API_BASE_URL!, // your AIRCTRL API base URL
  auth: process.env.AC_TOKEN!,           // personal access token (sk-actrl-pat-…)
})

// Decrypt one record
const secret = await airctrl.getSecret({ recordId, vaultPassword })
console.log(secret.value)

// Decrypt every record in a project (e.g. to inject as env vars)
const all = await airctrl.getAll({ projectId, vaultPassword })
for (const s of all) console.log(s.name, s.value)

Service mode (machine-to-machine)

import { createServiceClient } from '@airctrl/sdk'

const svc = createServiceClient({
  baseUrl: process.env.AC_API_BASE_URL!,
  auth: process.env.AC_SERVICE_TOKEN!, // service-account token
})

Zero-knowledge

Plaintext is never transmitted. The SDK fetches the ciphertext plus your wrapped record key, unwraps it locally with your vault passphrase, and decrypts in-process (AES-256-GCM · X25519).

© AIRCTRL — all rights reserved (license TBD) · airctrl.dev