rq.vault (Vault object)

The rq.vault object provides read access to encrypted secrets stored in the Requestly Vault during script execution. Vault secrets are kept out of collections, exports, and cloud sync. Only {{vault:key}} references travel with your project, while the resolved values stay on the user’s machine.

rq.vault is only available in the Requestly desktop app, and Vault is rolling out behind a feature flag. If the Vault surface is not visible in your build, contact support to confirm it is enabled for your account. Vault features are disabled in the web-only mode.

rq.vault is read-only from scripts. You can read and check secrets, but you cannot create, update, or delete them from a script. Manage secrets from the Vault page. To store a derived value at request time, write it to a variable with rq.variables.set() instead.

Methods

`rq.vault.get(key)`

Retrieves the value of a vault secret. Works for both local secrets and external provider secrets, such as AWS Secrets Manager and Azure Key Vault, that have been fetched into the vault. Parameters:

key (string): The name of the vault secret to retrieve

Returns: The secret’s string value, or undefined if the key doesn’t exist. This call is synchronous (no await needed). Example:

const apiKey = rq.vault.get("my-api-key");
console.log("Key loaded:", Boolean(apiKey));

`rq.vault.has(key)`

Checks whether a vault secret with the given key exists. Works for both local secrets and external provider secrets fetched into the vault. Parameters:

key (string): The name of the vault secret to check

Returns: true if the secret exists, false otherwise. This call is synchronous. Example:

if (rq.vault.has("signing-key")) {
  const key = rq.vault.get("signing-key");
  // generate JWT...
}

`rq.vault.toObject()`

Returns all available vault secrets as a plain object of key/value pairs. Useful for iterating over or inspecting the secrets your script can see. Returns: An object mapping each secret’s key to its string value. Example:

const secrets = rq.vault.toObject();
console.log("Available keys:", Object.keys(secrets));

Common Use Cases

Generate a JWT Without Exposing the Signing Key

Keep the signing key inside the vault and expose only the generated token to the request:

// Pre-request script
const signingKey = rq.vault.get("signing-key");
const jwt = generateJwt(payload, signingKey);
rq.variables.set("auth-token", jwt);

Then reference {{auth-token}} in the Authorization header. The signing key never leaves the vault.

Cache a Short-Lived Token for the Current Run

Fetch a token once, store it in a variable, and reuse it across subsequent requests until it expires. Use a variable (not the vault) because the vault is read-only from scripts:

let token = rq.variables.get("session-token");

if (!token) {
  const res = await fetch("https://auth.example.com/token", { /* ... */ });
  const body = await res.json();
  token = body.access_token;
  rq.variables.set("session-token", token);
}

rq.request.headers.add({ key: "Authorization", value: `Bearer ${token}` });

Guard Optional Secrets

Only apply a signing step when the signing key is configured:

if (rq.vault.has("hmac-secret")) {
  const secret = rq.vault.get("hmac-secret");
  const signature = signRequest(rq.request.body, secret);
  rq.request.headers.add({ key: "X-Signature", value: signature });
}

Behavior Notes

All methods are synchronous. get(), has(), and toObject() return their values directly. You do not need to await them.
Read-only from scripts. There is no set() or unset() on rq.vault. To create, update, or delete a secret, use the Vault page. To keep a derived value for the current run, use rq.variables.set().
Values are strings. get() always returns a string (or undefined).
JSON secrets from AWS auto-expand. For a secret named dbCredentials storing { "username": "admin" }, use rq.vault.get("dbCredentials.username") to read the nested value.
Masked in console. Values returned from rq.vault.get() are masked in the Requestly console output. They resolve correctly at request time, but never appear in plaintext in logs.
No cloud sync. Vault values stay on the current machine and are never included in collection exports or project sync.

Getting Started

API Design

Mock Server

Collaboration & Projects

Account & Administration

rq.vault (Vault object)

Methods

`rq.vault.get(key)`

`rq.vault.has(key)`

`rq.vault.toObject()`

Common Use Cases

Generate a JWT Without Exposing the Signing Key

Cache a Short-Lived Token for the Current Run

Guard Optional Secrets

Behavior Notes

​Methods

​rq.vault.get(key)

​rq.vault.has(key)

​rq.vault.toObject()

​Common Use Cases

​Generate a JWT Without Exposing the Signing Key

​Cache a Short-Lived Token for the Current Run

​Guard Optional Secrets

​Behavior Notes

​Related Documentation

Methods

`rq.vault.get(key)`

`rq.vault.has(key)`

`rq.vault.toObject()`

Common Use Cases

Generate a JWT Without Exposing the Signing Key

Cache a Short-Lived Token for the Current Run

Guard Optional Secrets

Behavior Notes

Related Documentation