variable

secrets

Securely store and retrieve sensitive credentials using the operating system's native credential storage.

Uses platform-specific secure storage:

  • macOS: Keychain Services
  • Linux: libsecret (GNOME Keyring, KWallet, and others)
  • Windows: Windows Credential Manager
import { secrets } from "bun";

// Store a credential
await secrets.set({
  service: "my-cli-tool",
  name: "github-token",
  value: "ghp_xxxxxxxxxxxxxxxxxxxx"
});

// Retrieve a credential
const token = await secrets.get({
  service: "my-cli-tool",
  name: "github-token"
});

if (token) {
  console.log("Token found:", token);
} else {
  console.log("Token not found");
}

// Delete a credential
const deleted = await secrets.delete({
  service: "my-cli-tool",
  name: "github-token"
});
console.log("Deleted:", deleted); // true if deleted, false if not found
function secrets.delete(
options: { name: string; service: string }
): Promise<boolean>;

Delete a stored credential from the operating system's secure storage.

@param options

The service and name identifying the credential

@returns

true if a credential was deleted, false if not found

// Delete a single credential
const deleted = await Bun.secrets.delete({
  service: "my-app",
  name: "api-key"
});

if (deleted) {
  console.log("Credential removed successfully");
} else {
  console.log("Credential was not found");
}
function secrets.get(
options: { name: string; service: string }
): Promise<null | string>;

Retrieve a stored credential from the operating system's secure storage.

@param options

The service and name identifying the credential

@returns

The stored credential value, or null if not found

const password = await Bun.secrets.get({
  service: "my-database",
  name: "admin"
});

if (password) {
  await connectToDatabase(password);
}
function secrets.set(
options: { allowUnrestrictedAccess: boolean; name: string; service: string; value: string }
): Promise<void>;

Store or update a credential in the operating system's secure storage.

If a credential already exists for the given service/name combination, it is replaced. The credential is encrypted by the operating system and only accessible to the current user.

@param options

The service and name identifying the credential, and the value to store

// Store an API key
await Bun.secrets.set({
  service: "openai-api",
  name: "production",
  value: "sk-proj-xxxxxxxxxxxxxxxxxxxx"
});