GUIDE
The client SDK
One client for every runtime. It finds its own credential, so the same code runs on managed compute and on anything else without a branch.
Install and read a secret
There is no configuration step. The SDK discovers how it is allowed to authenticate and uses the strongest option available.
import { ForgeZero } from '@forgezero/sdk';
const fz = new ForgeZero();
const key = await fz.get('STRIPE_KEY');How it finds a credential
On managed compute the agent socket exists, so the application holds no credential at all. Anywhere else it uses an API key. Moving an app onto managed compute means deleting an environment variable — there is no code change and no second code path to test.
/run/forgezero.sock present -> managed (agent signs; app holds nothing)
FORGEZERO_API_KEY present -> external (key is a signing seed)
neither -> throws, naming bothFull CRUD, and rotation without a restart
Secrets change under a running process. `watch` is what makes that usable: a value rotates centrally and the application reconnects. An environment variable cannot do this — it is fixed at exec time, so rotating it means restarting.
await fz.list();
await fz.set('STRIPE_KEY', value);
await fz.remove('STRIPE_KEY');
fz.watch('DATABASE_URL', (next) => pool.reconnect(next));What travels on the wire
Every call carries a per-request ML-KEM-768 public key inside a signed canonical string, and the reply is sealed to it. Recorded traffic plus a future quantum computer yields nothing, because the key existed for one request and died with the process.