GitHub Actions

Adding the Service Token

First, create a scoped service token from your workspace project under Service Tokens → New token (see Service tokens reference).

In your GitHub repository, navigate to Settings → Secrets and variables → Actions and click New repository secret:

• Name: APIVAULT_TOKEN
• Value: Paste your raw ApiVault service token (it starts with av_live_)

No other configuration is needed — the token already knows its project.

Workflow Example

Hand the token to the CLI as an environment variable in your step. Use npx apivault run to launch your build or test process:

name: Deploy Pipeline

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install dependencies
        run: npm ci

      - name: Build with secrets
        env:
          APIVAULT_TOKEN: ${{ secrets.APIVAULT_TOKEN }}
        run: npx apivault run -- npm run build

apivault run fetches the project's secrets, injects them as environment variables for the child process only, and never writes them to disk.

Environment Pinning

Notice that there is no --env flag in the workflow above. When a service token is pinned to an environment (such as Production or Staging), ApiVault supplies it automatically.

Pass --env only when using an unpinned token. If a token is pinned, passing a different environment is refused with 403 ENVIRONMENT_MISMATCH rather than silently returning incorrect secrets.

Custom Vault Key in CI

If your project uses custom encryption mode, the server cannot decrypt your secrets alone. You must supply your custom vault key alongside the service token:

env:
  APIVAULT_TOKEN: ${{ secrets.APIVAULT_TOKEN }}
  APIVAULT_KEY: ${{ secrets.APIVAULT_KEY }}
run: npx apivault run -- npm run build