npm install -g xtra-cli

Developer Quick Start

Integrate XtraSecurity into your application in 3 minutes. Use the CLI for local development, the REST API for programmatic access, or the SDK for framework-native integration.

Full Documentation →API ReferenceCLI Guide

Quick Start (3 Steps)

Get from zero to secure secret injection in under 3 minutes.

1Install the CLI

npm install -g xtra-cli

2Authenticate & Link Project

# Login to your XtraSecurity account
xtra login

# Link your current directory to a project
xtra projects set <your-project-id>

# Set branch and environment
xtra checkout main --env development

3Run with Injected Secrets

# Inject secrets into your process (recommended — no .env file created)
xtra run -e development -b main -- npm run dev

# Or sync to a local .env.local file
xtra local sync -e development -b main

REST API

Programmatic access to all XtraSecurity features. Authenticate with API keys or JWT tokens.

Authentication

# All API requests require a Bearer token
curl -X GET https://xtrasecurity.in/api/secret?branchId=<branch-id> \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json"

Core Endpoints

MethodEndpointDescription
GET/api/secret?branchId=:idList all secrets in a branch
POST/api/secretCreate a new secret
PUT/api/secret?id=:idUpdate an existing secret
DELETE/api/secret?id=:idDelete a secret
GET/api/branch?projectId=:idList branches in a project
POST/api/branchCreate a new branch
GET/api/projectsList all projects
POST/api/projectsCreate a new project
GET/api/audit?projectId=:idGet audit logs for a project
POST/api/access/requestRequest JIT access to a secret
POST/api/access/approveApprove or reject an access request
POST/api/rotation/schedulesCreate a rotation schedule

Example: Create a Secret

curl -X POST https://xtrasecurity.in/api/secret \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "DATABASE_URL",
    "value": "postgresql://user:pass@host:5432/db",
    "branchId": "<branch-id>",
    "environmentType": "production",
    "description": "Primary PostgreSQL connection string"
  }'

Example Response

{
  "id": "sec_abc123",
  "key": "DATABASE_URL",
  "type": "credential",
  "environmentType": "production",
  "version": 1,
  "createdAt": "2025-06-01T12:00:00Z",
  "description": "Primary PostgreSQL connection string"
}

Framework Integration

XtraSecurity works with any framework. Here are quick examples for popular tech stacks.

Node.js / Express

Use the CLI to inject env vars, then access them with process.env:

# Terminal: Start your Express server with injected secrets
xtra run -e production -b main -- node server.js

# server.js — access secrets normally via process.env
const express = require('express');
const app = express();

const dbUrl = process.env.DATABASE_URL;     // Injected by xtra-cli
const apiKey = process.env.STRIPE_API_KEY;   // Injected by xtra-cli

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

Next.js / React

Sync secrets to .env.local for Next.js development:

# Sync secrets to .env.local (Next.js reads this automatically)
xtra local sync -e development -b main

# Or inject directly without .env.local
xtra run -e development -b main -- npm run dev

# Access in your Next.js code:
# Server components: process.env.DATABASE_URL
# Client components: process.env.NEXT_PUBLIC_API_URL

Python / Django / Flask

The CLI injects secrets as environment variables, accessible via os.environ:

# Terminal: Run your Python app with injected secrets
xtra run -e production -b main -- python manage.py runserver

# settings.py — access secrets normally
import os

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'HOST': os.environ.get('DB_HOST'),
        'NAME': os.environ.get('DB_NAME'),
        'USER': os.environ.get('DB_USER'),
        'PASSWORD': os.environ.get('DB_PASSWORD'),
    }
}

CI/CD Integration

Pull secrets at build time without storing them in CI/CD configuration files.

GitHub Actions

# .github/workflows/deploy.yml
name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install xtra-cli
        run: npm install -g xtra-cli

      - name: Authenticate with XtraSecurity
        run: xtra login --token ${{ secrets.XTRA_API_TOKEN }}

      - name: Set project
        run: xtra projects set ${{ vars.XTRA_PROJECT_ID }}

      - name: Build with injected secrets
        run: xtra run -e production -b main -- npm run build

      - name: Deploy
        run: npm run deploy

GitLab CI

# .gitlab-ci.yml
deploy:
  stage: deploy
  image: node:20
  script:
    - npm install -g xtra-cli
    - xtra login --token $XTRA_API_TOKEN
    - xtra projects set $XTRA_PROJECT_ID
    - xtra run -e production -b main -- npm run build
    - npm run deploy
  only:
    - main

Ready to Build?

Start integrating XtraSecurity into your project today. Free plan includes 3 projects and 50 secrets.

Get Started Free →Full Documentation