Config

Config contracts (vault.config) hold non-secret operational settings — public origins, feature flags, workspace labels. They resolve through the same boot chain as secrets, but Console may show them in the clear.

For developers who need validated settings without fingerprinting — declare vault.config, read with fx.vault.get, keep credentials on vault.secret instead.

Smallest Example

import { vault } from "okengine";
import { z } from "zod";

export const publicAppUrl = vault.config("PUBLIC_APP_URL", {
  description: "Public origin for email links and redirects",
  schema: z.string().url(),
  // Dev-only fallback — never used in prod boot
  dev: "http://localhost:6530",
});

import { on, flow, http } from "okengine";
import { z } from "zod";
import { member } from "@/core/gate";
import { publicAppUrl, noteCreatedMail } from "@/core";

export const create = on(
  http
    .post({
      in: z.object({ email: z.string().email() }),
    })
    .gate(member),
  flow({
    do: async ({ email }, fx) => {
      const origin = await fx.vault.get(publicAppUrl);
      await fx.send(noteCreatedMail, {
        to: email,
        // Config may be revealed for URL building — still prefer holding Redacted
        // until the send boundary when mixed with secrets
        link: `${origin.reveal()}/accept`,
      });
      return fx.json.empty();
    },
  }),
);

Progressive Patterns

From a public URL to flags, registration, and the env escape hatch:

export const publicApiUrl = vault.config("PUBLIC_API_URL", {
  description: "Browser-facing API origin",
  schema: z.string().url(),
  dev: "http://localhost:6530",
});

Options Reference

Same option bag as secrets (VaultSecretOptions), with different defaults:

Empty name throws TypeError: vault.config: name is required.

Consequence: sensitive: true on a config behaves like a secret for Console cleartext — prefer vault.secret when that is the intent.

vault.env helpers

Synchronous reads of process environment. Empty strings count as unset.

Boolean true: 1 · true · yes · on. False: 0 · false · no · off (case-insensitive).

// TypeError: vault.env.required: CI_TOKEN is not set
vault.env.required("CI_TOKEN");

// TypeError: vault.env.int: PORT is not an integer
process.env.PORT = "abc";
vault.env.int("PORT");

Reach for vault.secret / vault.config when the value must participate in the resolution chain, fingerprinting, or Console Vault.

Cleartext vs fingerprint

Both still return Redacted from fx.vault.get — reveal when you need a plain string.

Troubleshooting

Learn more

• Secrets — fingerprinted contracts and Redacted
• Vault overview — resolution order and drivers
• Environment variables — OKE_* knobs
• fx — fx.vault.get on any contract

Next