@empyre/vault-sdk

Secrets, temporary credentials, and keyless signing for AI agents — the official SDK for Vault by Empyre.

Zero runtime dependencies. Works in Node 18+, Deno, Bun, browsers, and edge runtimes.

Install

npm i @empyre/vault-sdk

The package name is @empyre/vault-sdk (scoped). npm i empyre@vault-sdk will fail with a 404 — that syntax asks npm for a package called empyre at a version tag called vault-sdk.

Quick start

Create an agent at vault.empyre.dev/dashboard/agents and copy its vlt_live_… token (shown once). Write an allow policy for it on the Policies page — a new agent starts with zero access.

// agent.mjs — run with: node agent.mjs
import { VaultAgent } from "@empyre/vault-sdk";

const vault = new VaultAgent({ token: process.env.VAULT_AGENT_TOKEN });

const secrets = await vault.secrets.list();          // names + types only
const stripeKey = await vault.secrets.access(secrets[0].id); // decrypted value
console.log(stripeKey.value);

Secrets

await vault.secrets.list();               // VaultSecretSummary[] — no values
await vault.secrets.access(secretId);     // decrypts the current version

Temporary credentials

Mint a short-lived vlt_tmp_… token to hand to a sub-process instead of your agent's own long-lived token:

const cred = await vault.credentials.issue({ secretId, ttlMinutes: 15, maxReads: 3 });
// hand cred.token to the sub-process; it never sees vault.token

const value = await vault.credentials.redeem(cred.token);

Keyless signing

The private key never leaves the vault — you get a signature back, never the key material.

const keys = await vault.signingKeys.list();
const result = await vault.sign(keys[0].id, JSON.stringify({ event: "ping" }));
console.log(result.signature, result.public_key); // verify with result.public_key

Sign up to 20 payloads in one round-trip:

const results = await vault.signBatch([
  { keyId: keys[0].id, payload: "one" },
  { keyId: keys[0].id, payload: "two" },
]);

Verifying elsewhere without a copy-pasted public key? Fetch the org's JWKS:

GET https://api.empyre.dev/vault/.well-known/jwks/{org_id}

Errors

Every failed call throws VaultError with a status and a message that tells you what to do:

import { VaultError } from "@empyre/vault-sdk";

try {
  await vault.secrets.access(secretId);
} catch (err) {
  if (err instanceof VaultError && err.status === 403) {
    console.error("Denied by policy:", err.message);
  }
  throw err;
}

A 5xx response is retried once automatically before raising.

Reference

| Method | Endpoint | | --- | --- | | vault.me() | GET /vault/agent/me | | vault.secrets.list() | GET /vault/agent/secrets | | vault.secrets.access(id) | POST /vault/agent/secrets/{id}/access | | vault.credentials.issue({ secretId, ttlMinutes, maxReads }) | POST /vault/agent/credentials | | vault.credentials.redeem(token) | POST /vault/agent/credentials/redeem | | vault.signingKeys.list() | GET /vault/agent/signing-keys | | vault.sign(keyId, payload, encoding?) | POST /vault/agent/sign | | vault.signBatch(items) | POST /vault/agent/sign/batch |