kms/docs/documentation/guides/node.mdx

---
title: "Node"
---

This guide demonstrates how to use KMS to manage secrets for your Node stack from local development to production. It uses:

- KMS (you can use [KMS Cloud](https://kms.hanzo.ai) or a [self-hosted instance of KMS](https://kms.hanzo.ai/docs/self-hosting/overview)) to store your secrets.
- The [@hanzo/kms-sdk](https://github.com/KMS/node-sdk-v2) Node.js client SDK to fetch secrets back to your Node application on demand.

## Project Setup

To begin, we need to set up a project in KMS and add secrets to an environment in it.

### Create a project

1. Create a new project in [KMS](https://kms.hanzo.ai/).

2. Add a secret to the development environment of this project so we can pull it back for local development. In the **Secrets Overview** page, press **Explore Development** and add a secret with the key `NAME` and value `YOUR_NAME`.

### Create a Machine Identity

Now that we've created a project and added a secret to its development environment, we need to configure an KMS Machine Identity that our Node application can use to access the secret.

- [How to setup machine identities](/documentation/platform/identities/overview)


## Create a Node app

For this demonstration, we use a minimal Express application. However, the same principles will apply to any Node application such as those built on Koa or Fastify.

### Create an Express app

Initialize a new Node.js project with a default `package.json` file.

```console
npm init -y
```

Install `express` and [@hanzo/kms-sdk](https://www.npmjs.com/package/@hanzo/kms-sdk), the client Node SDK for KMS.

```console
npm install express @hanzo/kms-sdk
```

Finally, create an index.js file containing the application code.

```js
const express = require('express');
const { KMSSDK } = require("@hanzo/kms-sdk");


const app = express();

const PORT = 3000;

let client;

const setupClient = () => {  

  if (client) {
    return;
  }

  const kmsSdk = new KMSSDK({
      siteUrl: "your-kms-instance.com" // Optional, defaults to https://kms.hanzo.ai
  });

  await kmsSdk.auth().universalAuth.login({
    clientId: "<machine-identity-client-id>",
    clientSecret: "<machine-identity-client-secret>"
  });

  // If authentication was successful, assign the client
  client = kmsSdk;
}



app.get("/", async (req, res) => {
    

    const name = await client.secrets().getSecret({
      environment: "dev", // dev, staging, prod, etc.
      projectId: "<project-id>",
      secretPath: "/",
      secretName: "NAME"
    });
    
    res.send(`Hello! My name is: ${name.secretValue}`);
});

app.listen(PORT, async () => {
  // initialize http server and KMS
    await setupClient();
    console.log(`Server listening on port ${PORT}`);
});
```

Here, we initialized a `client` instance of the KMS Node SDK with the [Machine Identity](/documentation/platform/identities/overview)
that we created earlier, giving access to the secrets in the development environment of the
project in KMS that we created earlier.

Finally, start the app and head to `http://localhost:3000` to see the message **Hello, Your Name**.

```console
node index.js
```

The client fetched the secret with the key `NAME` from KMS that we returned in the response of the endpoint.

At this stage, you know how to fetch secrets from KMS back to your Node application.
By using Machine Identities scoped to different projects and environments, you can easily manage secrets across various stages of your project in KMS, from local development to production.

## FAQ

<AccordionGroup>
    <Accordion title="What if a request for a secret fails?">
        The SDK caches every secret and falls back to the cached value if a request fails. If no cached
        value ever-existed, the SDK falls back to whatever value is on `process.env`.
    </Accordion>
    <Accordion title="What's the point if I still have to manage a token for the SDK?">
        The token enables the SDK to authenticate with KMS to fetch back your secrets.
        Although the SDK requires you to pass in a token, it enables greater efficiency and security
        than if you managed dozens of secrets yourself without it. Here're some benefits:

        - You always pull in the right secrets because they're fetched on demand from a centralized source that is KMS.
        - You can use the KMS which comes with tons of benefits like secret versioning, access controls, audit logs, etc.
        - You now risk leaking one token that can be revoked instead of dozens of raw secrets.
        
        And much more.
    </Accordion>
    
</AccordionGroup>

See also:

- Explore the [Node SDK](https://github.com/KMS/node-sdk-v2)