Node SDK

@shushsecrets/inject is the programmatic SDK. It has zero runtime dependencies and uses the platform fetch (Node ≥ 18, Bun, Deno, browsers).

Install


bun add @shushsecrets/inject
# or: npm install @shushsecrets/inject

API

`injectEnv(opts: InjectOptions): Promise<Record<string, string>>`

Fetches secrets and assigns them onto a target object (default process.env). Existing keys on the target are preserved unless override: true. Returns the fetched map.


import { injectEnv } from "@shushsecrets/inject";
 
await injectEnv({
  apiKey: process.env.SHUSH_API_KEY!,
  env: process.env.NODE_ENV === "production" ? "prod" : "dev",
});
 
// process.env.STRIPE_SECRET_KEY etc. are now populated.

`fetchSecrets(opts: InjectOptions): Promise<Record<string, string>>`

Lower-level: fetches secrets from the runtime API and returns them as a map. Does not mutate process.env. Uses the same in-memory cache and retry policy as injectEnv.


import { fetchSecrets } from "@shushsecrets/inject";
 
const values = await fetchSecrets({
  apiKey: process.env.SHUSH_API_KEY!,
  env: "prod",
});
console.log(Object.keys(values));

`clearCache(): void`

Clears the in-memory secrets cache. Mostly useful in tests.

Types

`EnvKey`


type EnvKey = "dev" | "staging" | "preview" | "prod";

`InjectOptions`


interface InjectOptions {
  /** API key (format: `shush_xxxx`). */
  apiKey: string;
  /** Logical environment. Defaults to a mapping of `process.env.NODE_ENV`. */
  env?: EnvKey;
  /** Override the API base URL. Falls back to `SHUSH_API_URL`, then default. */
  baseUrl?: string;
  /** Where to assign env vars. Defaults to `process.env`. */
  target?: NodeJS.ProcessEnv;
  /** If `true`, overwrite existing values in `target`. Defaults to `false`. */
  override?: boolean;
  /** In-memory cache TTL (ms). Defaults to 30_000. */
  cacheTtlMs?: number;
  /** Optional AbortSignal to cancel the fetch. */
  signal?: AbortSignal;
}

Behavior

Caching. Results are cached in-process for cacheTtlMs (default 30 seconds), keyed by apiKey + env + baseUrl. Set cacheTtlMs: 0 to disable.
Retries. Network errors retry 3 times with exponential backoff (300 ms, 900 ms, 2700 ms).
Auth failures are fatal. 401 and 403 responses are not retried — they throw a ShushAuthError immediately.
Defaults. env falls back to a mapping of NODE_ENV (production → prod, anything else → dev). baseUrl falls back to SHUSH_API_URL, then https://api.shush.local.

Source

packages/inject/src/index.ts.