Get Secret(s)

SDK usage

url and api_key (or apiKey) default to the SHIELD360_URL and SHIELD360_API_KEY environment variables if you don’t pass them explicitly.

Python
TypeScript

import shield360

response = shield360.get_secrets(
  should_set_env=True
)

print(response)

{
  err: null,
  res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
}

Parameter	Description
`url`	Sets the Shield360 URL. Defaults to the `SHIELD360_URL` environment variable.
`api_key`	Sets the Shield360 API Key. Can also be provided via the `SHIELD360_API_KEY` environment variable.
`key`	Sets the key to fetch a specific secret. Optional
`should_set_env`	Boolean value that sets all the secrets as environment variables for the application. Optional
`tags`	Sets the tags for fetching only the secrets that have the mentioned tags assigned. Optional

should_set_env is client-side only: it doesn’t change what’s sent to Shield360, or what comes back in the response. It only controls whether the SDK, after receiving the secrets, also sets them directly as environment variables in your running process.

import Shield360 from 'shield360';

const response = await Shield360.getSecrets({
  shouldSetEnv: true,
});

console.log(response);

{
  err: null,
  res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
}

Parameter	Description
`url`	Sets the Shield360 URL. Defaults to the `SHIELD360_URL` environment variable.
`apiKey`	Sets the Shield360 API Key. Can also be provided via the `SHIELD360_API_KEY` environment variable.
`key`	Sets the key to fetch a specific secret. Optional
`tags`	Sets the tags for fetching only the secrets that have the mentioned tags assigned. Optional
`shouldSetEnv`	Boolean value that sets all the secrets as environment variables for the application. Optional

Cross-origin browser requests

POST /api/vault/get-secrets is an API-key authenticated endpoint for retrieving Vault secrets. Browser requests from a different origin are blocked unless the calling origin is explicitly allowed.

To allow a browser application hosted on another domain, configure the Shield360 deployment with a comma-separated origin allowlist:

SHIELD360_ALLOWED_CORS_ORIGINS="https://app.example.com,https://admin.example.com"

SHIELD360_ALLOWED_ORIGINS is also supported as a backward-compatible alias. NEXTAUTH_URL is automatically treated as an allowed same-site origin.

Use complete origins such as https://app.example.com. Do not configure wildcard origins for this endpoint.