Appearance
Get Secret(s)
url and api_key default to ELSAI_ARMS_URL and ELSAI_ARMS_API_KEY.
Python
python
import elsai_arms
response = elsai_arms.get_secrets(should_set_env=True)
print(response)| Parameter | Description |
|---|---|
url | ARMS base URL. Defaults to ELSAI_ARMS_URL. |
api_key | API key. Defaults to ELSAI_ARMS_API_KEY. Sent as Authorization: Bearer. |
key | Optional exact secret key. |
should_set_env | If true, set returned secrets on os.environ after a successful fetch. |
tags | Optional tag filter. |
POST /api/vault/get-secrets is API-key authenticated.
| Situation | HTTP |
|---|---|
| Missing or invalid Bearer key | 401 |
Browser Origin not allowed | 403 |
Do not treat HTTP 200 as the only success signal when debugging CORS or keys.
Cross-origin browser requests
Browser calls from another origin need that origin on the server allow-list:
bash
ELSAI_ALLOWED_CORS_ORIGINS="https://app.example.com,https://admin.example.com"ELSAI_ALLOWED_ORIGINS is an alias. NEXTAUTH_URL is also allowed. Server-to-server SDK calls do not send Origin and do not need CORS.