This is Bitwarden Secrets Manager, not the password vault.
Authentication
BWS_API_URL and BWS_IDENTITY_URL.
Two ways to address a secret
Bitwarden addresses secrets by UUID, with no path hierarchy:BWS_ORGANIZATION_ID is set, you can use the human-readable secret name
(Bitwarden’s “key” field) instead, resolved via one cached lookup:
Why this provider is different
Bitwarden secrets are end-to-end encrypted. There is no plain authenticated REST call that returns a value — the official SDK derives a decryption key from the access token at login and decrypts client-side. That is why this provider depends on@bitwarden/sdk-napi rather than making an HTTP call.
Nothing is written to disk unless you explicitly opt into a stateFile.