Secret Manager

Fetch the encrypted Master Encryption Key (MEK) for an app.

Scope: full-access or secret-read

Path param: appId — the App ID from the secret manager dashboard (set as {{appId}} in your environment)

Success — 200 OK

{
  "encryptedMek": "<base64-encoded-encrypted-key>",
  "algorithm": "AES-256-GCM",
  "kdfAlgorithm": "HKDF-SHA256"
}

Decrypt the MEK using your App Secret:

const mek = await crypto.subtle.decrypt(
  { name: 'AES-GCM', iv: decodeBase64(iv) },
  await deriveKey(appSecret),  // HKDF-SHA256
  decodeBase64(encryptedMek)
);

Common errors

• 401 — invalid API key
• 403 — key lacks secret-read scope
• 404 — app not found
• 429 — rate limited (50 req/hour)

Fetch encrypted environment variables for an app.

Scope: full-access or secret-read

Path param: appId — App ID from dashboard Query param: environment (optional) — development | staging | production (default: development)

Success — 200 OK

{
  "environment": "production",
  "variables": [
    { "key": "DATABASE_URL", "encryptedValue": "<base64>", "iv": "<base64>" },
    { "key": "STRIPE_SECRET_KEY", "encryptedValue": "<base64>", "iv": "<base64>" }
  ]
}

Decrypt each variable using the MEK from GET master-key:

const plaintext = await crypto.subtle.decrypt(
  { name: 'AES-GCM', iv: decodeBase64(variable.iv) },
  mek,
  decodeBase64(variable.encryptedValue)
);

Common errors

• 401 — invalid API key
• 403 — key lacks secret-read scope
• 404 — app not found or no variables for this environment

The nism CLI (recommended for local dev and CI)link

The published CLI/SDK nismsdk wraps the fetch + local-decrypt flow — secrets are decrypted on your machine with the App Secret; plaintext never transits the platform:

npm install -g nismsdk        # provides the `nism` and `nismsdk` binaries

nism setup                    # store appId / orgId / apiKey / appSecret in ~/.nism
nism verify                   # check the App Secret against the server key-check
nism env --environment production --create-env   # write decrypted vars to .env
nism load -- node server.js   # inject decrypted vars into a child process

Point it at the live platform with NISM_GRAPHQL_URL=https://service.newinstance.cloud/service (or --graphqlUrl). Auth uses the same x-api-key central key plus your appId/orgId; the App Secret is never sent — it only decrypts locally.