Docs

Docker, Kubernetes & REST

Deploy containerized applications with in-memory secret injection, mount secrets in Kubernetes clusters, or query ApiVault endpoints directly via headless HTTP requests.

Docker Container Execution

Pass the service token into your container at runtime. Avoid baking tokens into your Dockerfile or intermediate image layers:

Docker RunShell
docker run --rm \
  -e APIVAULT_TOKEN="$APIVAULT_TOKEN" \
  my-app:latest npx apivault run -- node server.js

Because apivault run launches the command as a child process and injects secrets directly into environment memory, no unencrypted files are written to the container filesystem.

Kubernetes Pods

Store your service token in a Kubernetes Secret, then map it into your deployment pod specifications:

deployment.yamlShell
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
spec:
  template:
    spec:
      containers:
        - name: app
          image: my-app:latest
          command: ["npx", "apivault", "run", "--", "node", "server.js"]
          env:
            - name: APIVAULT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: apivault-secrets
                  key: service-token

Headless REST API (Without CLI)

In minimal environments without Node.js, you can consume secrets using standard HTTP clients (e.g. curl, Python requests, or Go). A service token is passed as a standard HTTP Bearer token.

List keys (JSON)Shell
curl https://apivault.tech/api/keys \
  -H "Authorization: Bearer $APIVAULT_TOKEN"
Export environment variables (.env format)Shell
curl "https://apivault.tech/api/keys/export?environment=Production" \
  -H "Authorization: Bearer $APIVAULT_TOKEN"

Endpoint confinement: Service tokens reach the key endpoints only. Project settings, members, invitations, encryption configuration and token creation itself all reject them, so a leaked CI credential cannot add a collaborator, rotate your vault key, or mint a replacement for itself.