# SecRefs

- [SecRefs](https://docs.secrefs.com/index.md): Put a reference in your config instead of a secret. Resolve it from your own vault, in memory, at the moment it's used.
- [Quickstart (Node.js)](https://docs.secrefs.com/getting-started/quickstart-node.md): Replace a secret in your .env with a reference, and run your app through SecRefs.
- [Quickstart (Python)](https://docs.secrefs.com/getting-started/quickstart-python.md): The same reference workflow, for Python applications.
- [Reference syntax](https://docs.secrefs.com/getting-started/references.md): What sec://aws/prod/db#password means, piece by piece.
- [AWS Secrets Manager](https://docs.secrefs.com/guides/aws.md): sec://aws/... — authenticated by the credential chain you already use.
- [Bitwarden Secrets Manager](https://docs.secrefs.com/guides/bitwarden.md): sec://bitwarden/... — end-to-end encrypted, decrypted client-side.
- [HashiCorp Vault](https://docs.secrefs.com/guides/vault.md): sec://vault/... — KV v1 and v2, using the token already in your environment.
- [Local (development only)](https://docs.secrefs.com/guides/local.md): sec://local/... — a gitignored JSON file for people without vault access yet.
- [Load time vs use time](https://docs.secrefs.com/guides/load-time-vs-use-time.md): The one decision that determines whether a rotated secret reaches your process.
- [Multiple accounts and vaults](https://docs.secrefs.com/guides/multiple-accounts.md): Two AWS accounts, three Bitwarden projects, one config.
- [Troubleshooting](https://docs.secrefs.com/guides/troubleshooting.md): What a failure is telling you, and what to do about it.
- [CLI](https://docs.secrefs.com/reference/cli.md): secrefs run, secrefs check.
- [Node API](https://docs.secrefs.com/reference/node-api.md): @secrefs/node — the SecRefs class, providers, and errors.