seekrit — JavaScript / TypeScript SDK

Read-path SDK for seekrit. Authenticate with a service token, resolve your environment, and get decrypted secrets — the API only ever returns ciphertext; decryption happens in your process.

Pure WebCrypto + global fetch, so it runs unchanged on Node 18+, Bun, Deno, browsers, and Cloudflare Workers — no Node built-ins, no polyfills.

This repo is a read-only mirror published from seekrit's monorepo so the code that holds your token and decrypts plaintext is auditable. Don't commit here — it's overwritten on each sync. Issues and PRs welcome.

Install

npm install @seekrit/sdk      # or: pnpm add / yarn add / bun add

Deno:

import { Seekrit } from "npm:@seekrit/sdk";

Usage

import { Seekrit } from "@seekrit/sdk";

const client = new Seekrit();          // token from $SEEKRIT_TOKEN
const secrets = await client.resolve(); // { DATABASE_URL: "postgres://…", … }

const dbUrl = await client.get("DATABASE_URL");

Cloudflare Workers

There's no ambient environment, so pass the token from your Worker's env:

export default {
  async fetch(request, env) {
    const client = new Seekrit({ token: env.SEEKRIT_TOKEN });
    const { API_KEY } = await client.resolve();
    // ...
  },
};

Options

new Seekrit({
  token: "skt_…",                       // default: $SEEKRIT_TOKEN
  apiUrl: "https://api.seekrit.dev",    // default: $SEEKRIT_API_URL or hosted
  with: { shared: "dev" },              // ?with= override for a composed group
  fetch: customFetch,                   // default: globalThis.fetch
});

A service token binds to a single app environment (plus its composed group slices). with pulls a different environment slice of a composed group.

Errors

• SeekritApiError — non-2xx from the API; has .status and .code ("unauthorized", "forbidden", "not_found", …).
• SeekritCryptoError — a token or ciphertext could not be parsed/decrypted.
• SeekritError — base class (also covers network failures).

resolve() is fail-closed: it rejects rather than returning partial results.

Zero-knowledge

GET /v1/resolve returns ciphertext plus a data-encryption key wrapped to your token's public key. This SDK recovers the token's private key, unwraps the DEK (ECDH P-256 → HKDF-SHA256 → AES-256-GCM), and decrypts each secret (AES-256-GCM, AAD-bound to environmentId/NAME) — the exact scheme used by the CLI, seekrit run, and every other seekrit client. See seekrit.dev/docs.

License

MIT