1# Key Vault Secrets — TypeScript SDK Quick Reference
2 
3> Condensed from **azure-keyvault-secrets-ts**. Full patterns (key rotation,
4> cryptographic operations, backup/restore, wrap/unwrap)
5> in the **azure-keyvault-secrets-ts** plugin skill if installed.
6 
7## Install
8npm install @azure/keyvault-secrets @azure/identity
9 
10## Quick Start
11```typescript
12import { DefaultAzureCredential } from "@azure/identity";
13import { SecretClient } from "@azure/keyvault-secrets";
14const client = new SecretClient("https://<vault>.vault.azure.net", new DefaultAzureCredential());
15```
16 
17## Best Practices
18- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCredential — see [auth-best-practices.md](../auth-best-practices.md)
19- Enable soft-delete — required for production vaults
20- Set expiration dates on both keys and secrets
21- Use key rotation policies — automate key rotation
22- Limit key operations — only grant needed operations (encrypt, sign, etc.)
23- Browser not supported — these SDKs are Node.js only
24