Indiko.KeyStorage.Client 1.3.0

Indiko.KeyStorage.Client

A .NET client library for Indiko.KeyStorage — a self-hosted secrets management vault. Store secrets centrally and inject them into your .NET apps via IConfiguration, just like appsettings.json.

Installation

dotnet add package Indiko.KeyStorage.Client

Quick Start

1. Add configuration

Add the vault connection to your appsettings.json:

{
  "Indiko.KeyStorage": {
    "BaseUrl": "https://your-keystorage-server",
    "ApiKey": "kss_your_api_key_here"
  }
}

2. Wire up in Program.cs

A single line loads all secrets into the configuration pipeline:

using Indiko.KeyStorage.Client;

var builder = WebApplication.CreateBuilder(args);

// Load secrets from the vault into IConfiguration
builder.Configuration.AddIndikoKeyStorage(builder.Configuration);

var app = builder.Build();

3. Use your secrets

Secrets are available like any other configuration value:

app.MapGet("/demo", (IConfiguration config) =>
{
    // Reads a secret stored in the vault
    var password = config["SmtpPassword"];

    // Connection strings work too
    var conn = config.GetConnectionString("DefaultDb");

    // Strongly-typed binding works as expected
    var smtp = config.GetSection("Smtp").Get<SmtpSettings>();
});

Configuration Provider

The configuration provider fetches all secrets at startup and merges them into IConfiguration. Secrets override values from appsettings.json and environment variables.

builder.Configuration.AddIndikoKeyStorage(builder.Configuration);

This reads BaseUrl and ApiKey from the Indiko.KeyStorage config section. If the server is unreachable, the app still starts — only the remote keys will be missing.

Advanced: Manual options

builder.Configuration.AddIndikoKeyStorage(options =>
{
    options.ServiceUrl = "https://your-keystorage-server";
    options.ApiKey     = "kss_your_api_key_here";
    options.CacheTtl   = TimeSpan.FromMinutes(5);
});

Typed HTTP Client (On-Demand Reads)

For scenarios where you need to fetch secrets at runtime (outside the startup configuration pipeline):

var kss = builder.Configuration.GetSection("Indiko.KeyStorage");

builder.Services.AddIndikoKeyStorage(options =>
{
    options.ServiceUrl = kss["BaseUrl"] ?? "http://localhost:5000";
    options.ApiKey     = kss["ApiKey"]  ?? "";
    options.CacheTtl   = TimeSpan.FromMinutes(5);
});

Then inject IndikoKeyStorageClient in your services:

app.MapGet("/secret/{key}", async (string key, IndikoKeyStorageClient client) =>
{
    var secret = await client.GetSecretAsync(key);
    return secret is not null
        ? Results.Ok(new { secret.Key, secret.Value })
        : Results.NotFound();
});

Client Options

Features

• IConfiguration integration — secrets appear alongside appsettings.json values with zero code changes
• In-memory caching — configurable TTL to reduce server calls
• Resilient HTTP client — built-in retry policy via Polly
• Graceful degradation — if the vault is unreachable, the app starts without remote secrets
• Typed client — IndikoKeyStorageClient for on-demand secret reads with DI support
• Batch reads — fetch multiple secrets in a single call

Requirements

• .NET 10.0 or later
• A running Indiko.KeyStorage server instance

Links

• Server repository
• NuGet package

License

See LICENSE for details.