Go SDK

Read-only SDK for loading and watching secrets at runtime, without shipping the CLI binary alongside your service.

go get github.com/Omotolani98/foostash/sdk/go@latest

The SDK lives inside the main repo under sdk/go/ but is released with independent subdirectory tags (e.g. sdk/go/v0.1.0).

Usage

client, err := foostash.New(foostash.Config{
    ServerURL:  "https://foostash.example.com",
    Project:    "payments-api",
    Env:        "prod",
    SSHKeyPath: "/var/run/secrets/foostash-key",
    MasterKey:  os.Getenv("FOOSTASH_MASTER_KEY"),
})
if err != nil {
    log.Fatal(err)
}

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()

secrets, err := client.Pull(ctx)

Watching for changes

ch, err := client.Watch(ctx, 30*time.Second)
if err != nil {
    log.Fatal(err)
}
for snap := range ch {
    reloadConfig(snap.Secrets)
}

Watch polls on the given interval (clamped to a 5-second floor) and emits a Snapshot whenever a key version changes. The initial snapshot is emitted synchronously, so the first receive returns your current config. Transient network failures do not close the channel — attach a *slog.Logger with foostash.WithLogger(l) to observe them.

Requirements

• ·An SSH key registered with the server. Use the CLI once to provision a service-account key, then mount the unencrypted private key. Passphrase-protected keys are not supported — they are for humans, not long-running services.
• ·The org master key. Base64, 32 bytes. Distribute via KMS, env var, or file mount. The SDK never reads ~/.foostash/.

Errors