@vaultdrop/sdk

Browser SDK for VaultDrop: AES-256-GCM (same format as the web app) and fetch helpers for creating secure links. Use it from React, Vue, Angular, or any app bundled with Vite, Webpack, or similar.

Plaintext and keys stay in the browser; the API only receives ciphertext.

Requirements

• A secure context (typically HTTPS, or localhost in dev) so crypto.subtle is available.
• fetch (standard in modern browsers).

Install

npm install @vaultdrop/sdk

Usage

Build FileInput values from <input type="file">, File.arrayBuffer(), or Uint8Array / ArrayBuffer.

import { VaultDropClient } from "@vaultdrop/sdk";

const client = new VaultDropClient({
  apiKey: import.meta.env.VITE_VAULTDROP_API_KEY,
  workspaceId: 'ws-[WORKSPACE-ID]', // workspace id string, e.g. "ws-1234567890"
});

const { url, expiresAt } = await client.createSecureLink({
  text: "Secret message",
  expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
});
// `url` is the full share link; `expiresAt` matches the expiry you requested.

Attachments from a file input:

async function onFileSelected(file: File) {
  const data = new Uint8Array(await file.arrayBuffer());
  await client.createSecureLink({
    text: "See attachment",
    files: [{ name: file.name, mimeType: file.type || "application/octet-stream", data }],
    expiresAt: new Date(Date.now() + 86_400_000),
  });
}

API keys in the browser

A token embedded in frontend code can be extracted. For public sites, prefer a backend you control that holds the token and talks to VaultDrop. Client-side keys are mainly for internal or trusted tools.

CORS

If the API lives on another origin, that API must allow your app’s origin and headers such as Authorization and X-Workspace-Id for the vault-link and upload endpoints.

License

MIT