> ## Documentation Index
> Fetch the complete documentation index at: https://docs.requestly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# rq.vault (Vault object)

> Complete reference for the rq.vault object in Requestly scripts to read encrypted secrets from the local vault and AWS Secrets Manager.

The `rq.vault` object provides read access to encrypted secrets stored in the Requestly [Vault](/api-client/vault) during script execution. Vault secrets are kept out of collections, exports, and cloud sync. Only `{{vault:key}}` references travel with your project, while the resolved values stay on the user's machine.

<Info>
  `rq.vault` is only available in the **Requestly desktop app**, and Vault is rolling out behind a feature flag. If the Vault surface is not visible in your build, contact support to confirm it is enabled for your account. Vault features are disabled in the web-only mode.
</Info>

<Note>
  `rq.vault` is **read-only from scripts**. You can read and check secrets, but you cannot create, update, or delete them from a script. Manage secrets from the [Vault page](/api-client/vault). To store a derived value at request time, write it to a variable with `rq.variables.set()` instead.
</Note>

## Methods

### `rq.vault.get(key)`

Retrieves the value of a vault secret. Works for both **local** secrets and external provider secrets, such as **AWS Secrets Manager** and **Azure Key Vault**, that have been fetched into the vault.

**Parameters:**

* `key` (string): The name of the vault secret to retrieve

**Returns:** The secret's string value, or `undefined` if the key doesn't exist. This call is **synchronous** (no `await` needed).

**Example:**

```jsx theme={null}
const apiKey = rq.vault.get("my-api-key");
console.log("Key loaded:", Boolean(apiKey));
```

### `rq.vault.has(key)`

Checks whether a vault secret with the given key exists. Works for both local secrets and external provider secrets fetched into the vault.

**Parameters:**

* `key` (string): The name of the vault secret to check

**Returns:** `true` if the secret exists, `false` otherwise. This call is **synchronous**.

**Example:**

```jsx theme={null}
if (rq.vault.has("signing-key")) {
  const key = rq.vault.get("signing-key");
  // generate JWT...
}
```

### `rq.vault.toObject()`

Returns all available vault secrets as a plain object of key/value pairs. Useful for iterating over or inspecting the secrets your script can see.

**Returns:** An object mapping each secret's key to its string value.

**Example:**

```jsx theme={null}
const secrets = rq.vault.toObject();
console.log("Available keys:", Object.keys(secrets));
```

## Common Use Cases

### Generate a JWT Without Exposing the Signing Key

Keep the signing key inside the vault and expose only the generated token to the request:

```jsx theme={null}
// Pre-request script
const signingKey = rq.vault.get("signing-key");
const jwt = generateJwt(payload, signingKey);
rq.variables.set("auth-token", jwt);
```

Then reference `{{auth-token}}` in the Authorization header. The signing key never leaves the vault.

### Cache a Short-Lived Token for the Current Run

Fetch a token once, store it in a variable, and reuse it across subsequent requests until it expires. Use a variable (not the vault) because the vault is read-only from scripts:

```jsx theme={null}
let token = rq.variables.get("session-token");

if (!token) {
  const res = await fetch("https://auth.example.com/token", { /* ... */ });
  const body = await res.json();
  token = body.access_token;
  rq.variables.set("session-token", token);
}

rq.request.headers.add({ key: "Authorization", value: `Bearer ${token}` });
```

### Guard Optional Secrets

Only apply a signing step when the signing key is configured:

```jsx theme={null}
if (rq.vault.has("hmac-secret")) {
  const secret = rq.vault.get("hmac-secret");
  const signature = signRequest(rq.request.body, secret);
  rq.request.headers.add({ key: "X-Signature", value: signature });
}
```

## Behavior Notes

* **All methods are synchronous.** `get()`, `has()`, and `toObject()` return their values directly. You do not need to `await` them.
* **Read-only from scripts.** There is no `set()` or `unset()` on `rq.vault`. To create, update, or delete a secret, use the [Vault page](/api-client/vault). To keep a derived value for the current run, use `rq.variables.set()`.
* **Values are strings.** `get()` always returns a string (or `undefined`).
* **JSON secrets from AWS auto-expand.** For a secret named `dbCredentials` storing `{ "username": "admin" }`, use `rq.vault.get("dbCredentials.username")` to read the nested value.
* **Masked in console.** Values returned from `rq.vault.get()` are masked in the Requestly console output. They resolve correctly at request time, but never appear in plaintext in logs.
* **No cloud sync.** Vault values stay on the current machine and are never included in collection exports or project sync.

## Related Documentation

* [Vault Overview](/api-client/vault)
* [Pre-request & Post-response Scripts](/api-client/scripts)
* [rq.sendRequest Object](/api-client/rq-api-reference/rq-send-request)
* [rq.execution Object](/api-client/rq-api-reference/rq-execution)
* [rq.request Object](/api-client/rq-api-reference/rq-request)
* [rq.response Object](/api-client/rq-api-reference/rq-response)
* [rq.environment Object](/api-client/rq-api-reference/rq-environment)
* [rq.globals Object](/api-client/rq-api-reference/rq-globals)