# Loading secrets into a process

`zero vault run` starts a command with an environment's secrets available to it
and writes no file to disk. It is the preferred way to load secrets. The `zero`
CLI runs anywhere Node runs.

## Into any command

```bash
zero vault run -p demo -e production -- node server.js
```

The command gets each secret as an environment variable. Your code reads
`process.env.API_TOKEN` as usual. When the command exits, nothing is left
behind.

`zero vault run` exits with the exit code of your command, so a CI job still
fails when the command fails. `Ctrl+C` stops the command.

A secret overrides a variable of the same name that is already set. Put your
command after `--`, so its own flags are not read as flags of `zero`.

## Into a tool that reads a dotenv file

Some tools read a file instead of the environment. Wrangler is one: it reads
`.dev.vars`. For those, use `--mount`:

```bash
zero vault run -p demo -e development --mount .dev.vars -- wrangler dev
```

`--mount` creates a named pipe at that path and serves the secrets through it
for as long as the command runs. The tool reads it like an ordinary file, but no
plaintext is written to the disk, and the pipe is removed when the command
exits. Use `--mount-format json` for a tool that reads JSON.

Two rules apply:

- If the path already exists, the command stops. It never replaces a file that
  you created.
- With `--mount`, the secrets are not put in the environment. The pipe is the
  only copy.

Named pipes need Linux or macOS. On Windows, use the environment variables.

## Refused names

Some variable names change how a program starts, and one of them in your vault
would let the vault run code in your process. `zero vault run` refuses to set
them and names the key. `NODE_OPTIONS`, `LD_PRELOAD` and `PYTHONWARNINGS` are
three of the eleven. Rename the secret, or pass it with `--mount`.

## Into a file, when you have no other option

`zero vault secrets download` writes the secrets in the format the target reads.
Every download is plaintext, so delete the file after you load it.

```bash
zero vault secrets download -p demo -e production -f env -o .env
node -r dotenv/config server.js
rm .env
```

You can also emit shell `export` lines and source them into the current shell:

```bash
eval "$(zero vault secrets download -p demo -e production -f shell)"
```

## Formats

`-f` (`--format`) picks the output; `-o` (`--output`) writes to a file instead of
stdout.

| Format | Output |
|---|---|
| `env` (default) | `KEY=VALUE` lines. A multiline value is quoted, with `\n` escaped |
| `shell` | `export KEY="VALUE"` lines for sourcing |
| `json` | a flat `{ "KEY": "VALUE" }` object |
| `yaml` | `KEY: "VALUE"` lines |

## Next

- [Deploy to a platform](/vault/workers/): push the environment to a Cloudflare
  Worker at deploy time.
- [Vault commands](/vault/cli/): the full `zero vault` command set.