Vault Secrets

InertJS doesn't use standard .env files. Instead, it utilizes a proprietary, encrypted, zero-trust secrets manager called Vault.

Why not .env?

Plaintext .env files are a massive security liability. They often leak into source control, get exposed via misconfigured servers, or are stolen by malicious npm packages. InertJS encrypts your secrets at rest and only decrypts them in memory during runtime.

Managing Secrets

Use the InertJS CLI to safely manage your secrets:

// Initialize a new vault $ npx inert vault init // Set a secret (prompts for the value securely) $ npx inert vault set DATABASE_URL // List keys (values remain hidden) $ npx inert vault list

Migration & Server Deployments

When a vault is generated, the encrypted secrets are placed in the .vault-xxxxx directory (which should be committed to Git), but the Master Key used to decrypt them is saved in .vault.key in your project root.

Critical Security Warning

You must NEVER commit the .vault.key file to source control. It is automatically added to your .gitignore, but you should verify this.

When deploying to a production server (like Ubuntu or Linux), you must securely transfer your local .vault.key file to the project root on your server, or provide it via the INERT_VAULT_KEY environment variable as a base64 string.

Accessing Secrets

Inside your flux() server functions or wires, access your secrets via the injected scope.vaultHandle object. It uses getter functions to ensure secrets are never accidentally stringified or leaked in stack traces.

export async function flux({ scope }) { // Calling the getter decrypts the secret in memory const dbUrl = scope.vaultHandle.DATABASE_URL(); // Do something with it... const data = await db.connect(dbUrl); return { data }; }

Where does this go?

You place this code inside the flux() function of your route's view.js file (or a separate flux.js file). Since flux() always runs on the server, your secrets never touch the browser.

Report an issue Edit on GitHub