Loading secrets into a process

zero vault run starts a command with an environment’s secrets available to it and writes no file to disk. It is the preferred way to load secrets. The zero CLI runs anywhere Node runs.

Into any command

zero vault run -p demo -e production -- node server.js

The command gets each secret as an environment variable. Your code reads process.env.API_TOKEN as usual. When the command exits, nothing is left behind.

zero vault run exits with the exit code of your command, so a CI job still fails when the command fails. Ctrl+C stops the command.

A secret overrides a variable of the same name that is already set. Put your command after --, so its own flags are not read as flags of zero.

Into a tool that reads a dotenv file

Some tools read a file instead of the environment. Wrangler is one: it reads .dev.vars. For those, use --mount:

zero vault run -p demo -e development --mount .dev.vars -- wrangler dev

--mount creates a named pipe at that path and serves the secrets through it for as long as the command runs. The tool reads it like an ordinary file, but no plaintext is written to the disk, and the pipe is removed when the command exits. Use --mount-format json for a tool that reads JSON.

Two rules apply:

• If the path already exists, the command stops. It never replaces a file that you created.
• With --mount, the secrets are not put in the environment. The pipe is the only copy.

Named pipes need Linux or macOS. On Windows, use the environment variables.

Refused names

Some variable names change how a program starts, and one of them in your vault would let the vault run code in your process. zero vault run refuses to set them and names the key. NODE_OPTIONS, LD_PRELOAD and PYTHONWARNINGS are three of the eleven. Rename the secret, or pass it with --mount.

Into a file, when you have no other option

zero vault secrets download writes the secrets in the format the target reads. Every download is plaintext, so delete the file after you load it.

zero vault secrets download -p demo -e production -f env -o .env
node -r dotenv/config server.js
rm .env

You can also emit shell export lines and source them into the current shell:

eval "$(zero vault secrets download -p demo -e production -f shell)"

Formats

-f (--format) picks the output; -o (--output) writes to a file instead of stdout.

Format	Output
env (default)	KEY=VALUE lines. A multiline value is quoted, with \n escaped
shell	export KEY="VALUE" lines for sourcing
json	a flat { "KEY": "VALUE" } object
yaml	KEY: "VALUE" lines

Next

• Deploy to a platform: push the environment to a Cloudflare Worker at deploy time.
• Vault commands: the full zero vault command set.