Secrets JavaScript SDK

Pull your Hep.gg Secrets into process.env at launch with the unified hepgg package, a drop-in successor to hepgg-secrets.

Secrets SDK#

Secrets now ships inside the unified hepgg package on the hepgg/secrets subpath. It is the same one-shot, dotenv-style injector as the standalone hepgg-secrets package, with the same encrypted last-good cache and end-to-end encryption. Same function names, so moving over is a one-line import change.

Install#

npm install hepgg --registry https://npm.hep.gg

echo 'registry=https://npm.hep.gg' >> .npmrc
npm install hepgg

Use#

Call config() as the very first thing your app runs, before anything reads process.env.

import { config } from "hepgg/secrets";
 
await config({
  env: "production",
  token: process.env.HEPGG_SECRETS_TOKEN, // hsk_...
});
console.log(process.env.DATABASE_URL);

const { config } = require("hepgg/secrets");
(async () => {
  await config();
  require("./server");
})();

Coming From hepgg-secrets#

Change the import. That is the whole migration.

- import { config, get, all } from "hepgg-secrets";
+ import { config, get, all } from "hepgg/secrets";

Every option, env-var fallback (HEPGG_SECRETS_URL/ENV/TOKEN/KEY), the E2EE flow, and the accessors get() / all() are unchanged. The full option list lives on the npm package page and in Pull API.

import { config, get, all } from "hepgg/secrets";
await config();
get("DATABASE_URL"); // string | undefined
all();               // { DATABASE_URL: "...", ... }