Store secrets you must read back

At a glanceCopy Anchor Link

• Who: Node developers who keep third-party credentials (API keys, storage keys) in their own database.
• What: Encrypt a secret with AES-256-GCM under a key derived from your master, and open it again later.
• Use when: For credentials you must present to another service, so hashing is not an option.
• Avoid when: For user passwords (hash them) or when a managed secret store is available.
• See also: Derive purpose-bound keys from one master secret

InstallCopy Anchor Link

pnpm add @zedtech/zedkit-server

Latest: 1.1.0 (via changesets).

ExampleCopy Anchor Link

import { openSecret, sealSecret } from "@zedtech/zedkit-server";
const sealed = sealSecret(masterKey, "app/storage-credentials/v1", secretAccessKey);
const plain = openSecret(masterKey, "app/storage-credentials/v1", sealed);

Wraps: (none)