Step-by-step tutorials with working code examples for every platform
Get your first secret loaded in 5 minutes
Install the CLI
npm install -g xtra-cliAuthenticate
xtra loginCreate a Secret
xtra secret create --name "api-key" --value "your-secret-here"Retrieve the Secret
xtra secret get api-key// 1. Install CLI
npm install -g xtra-cli
// 2. Authenticate
xtra login
// 3. Load secret in Node.js
const { XtraClient } = require('@xtrasecurity/sdk-node');
const client = new XtraClient({
projectId: process.env.PROJECT_ID,
apiKey: process.env.API_KEY,
});
// Get secret
const apiKey = await client.getSecret('stripe-live-key');
// Use in your app
const stripe = require('stripe')(apiKey);
# Dockerfile with XtraSecurity init
FROM node:18-alpine
# Install XtraSecurity CLI
RUN npm install -g xtra-cli
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
# Load secrets at runtime
CMD ["xtra", "run", "--", "node", "app.js"]
# In your app.js:
const secret = await client.getSecret('db-password');
console.log('Connected to database');
name: Deploy
on:
push:
branches: [main]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
# Load secrets from XtraSecurity
- name: Get Deployment Secrets
env:
XTRA_API_KEY: ${{ secrets.XTRA_API_KEY }}
XTRA_PROJECT_ID: ${{ secrets.XTRA_PROJECT_ID }}
run: |
xtra login --api-key $XTRA_API_KEY --project $XTRA_PROJECT_ID
PROD_DB_PASSWORD=$(xtra get prod-db-password)
echo "DB_PASS=$PROD_DB_PASSWORD" >> $GITHUB_ENV
- name: Deploy to Production
env:
DB_PASSWORD: ${{ env.DB_PASS }}
run: ./deploy.sh
apiVersion: v1
kind: ConfigMap
metadata:
name: xtra-init
data:
init.sh: |
#!/bin/sh
xtra get prod-db-password > /secrets/db-password
xtra get stripe-api-key > /secrets/stripe-key
---
apiVersion: v1
kind: Pod
metadata:
name: app-pod
spec:
containers:
- name: app
image: myapp:latest
env:
- name: XTRA_API_KEY
valueFrom:
secretKeyRef:
name: xtra-creds
key: api-key
volumeMounts:
- name: secrets
mountPath: /secrets
initContainers:
- name: xtra-init
image: node:18-alpine
command: ["/bin/sh", "/scripts/init.sh"]
env:
- name: XTRA_API_KEY
valueFrom:
secretKeyRef:
name: xtra-creds
key: api-key
volumeMounts:
- name: scripts
mountPath: /scripts
- name: secrets
mountPath: /secrets
volumes:
- name: scripts
configMap:
name: xtra-init
- name: secrets
emptyDir: {}
Getting Started with XtraSecurity
Rotating Secrets in Production
Kubernetes Integration Setup