Installation
Add Vaultlier to your project. One package ships both the CLI and the runtime SDK.
Requirements
- Node.js 18 or newer for the CLI (it uses native
fetchand Web Crypto). - The runtime SDK is edge-safe and additionally runs on Bun, Deno, Cloudflare Workers, Vercel Edge, and AWS Lambda.
Install the package
Vaultlier is distributed as a single npm package. Install it as a dependency so the runtime SDK is available at deploy time, and use the bundled CLI via npx or your package scripts.
npm install vaultlier
# pnpm add vaultlier
# yarn add vaultlier
# bun add vaultlierRunning vaultlier initwill offer to install the dependency for you if it isn't present yet, detecting your package manager from the lockfile.
Entry points
The package exposes two import surfaces:
| Import | Surface | Environment |
|---|---|---|
vaultlier | Runtime SDK (createClient) | Edge-safe — Node 18+, Bun, Deno, Workers, Edge, Lambda |
vaultlier/cli | CLI programmatic API | Node-only |
The runtime entry uses only fetch and Web Crypto — no Node-only imports and no third-party dependencies.
Self-hosted portals
By default the CLI and SDK talk to the hosted portal at https://vaultlier.com/v1. The configured API base is https://vaultlier.com; versioned routes are appended by the client. Point them at a self-hosted deployment with the --api-url flag or the VAULTLIER_API_URL environment variable.
export VAULTLIER_API_URL=https://vault.internal.example.com
vaultlier pull --env=prodThe portal server itself requires a VAULT_MASTER_KEY — a 32-byte base64 key used to seal and unseal secret values. Generate one with vaultlier generate-key and set it in the deployment's server environment. It is validated at startup: a portal without a valid key fails to boot rather than serving broken secret operations.
vaultlier init creates an empty VAULT_MASTER_KEY="" placeholder in .env. Replace it only for the portal server or set the real value in your hosting provider's encrypted environment variables.
# on the portal server (set once, never change)
VAULT_MASTER_KEY=$(vaultlier generate-key)VAULT_MASTER_KEY like a root credential. It is read only server-side and never exposed to the browser. Changing or losing it makes every existing sealed secret unrecoverable — back it up the way you would a database master password.