```js
import { SecretClient } from "@azure/key-vault-secrets";
import { DefaultAzureCredential } from "@azure/identity";
const client = new SecretClient(
"https://YOUR-VAULT.vault.azure.net/",
new DefaultAzureCredential()
);
const secret value await client.getSecret("[secret-name]");
```
Traps, same family as Python:
- **Permission model.** RBAC ("Key Vault Secrets User") vs access policies. 403 = wrong model or missing grant. This is the number one Key Vault failure across languages.
- **Two packages.** `@azure/key-vault-secrets` and `@azure/identity` are separate installs. The number of broken builds from importing DefaultAzureCredential from the wrong package is embarrassing; check imports.
- **Async everywhere.** Every client method returns a promise. Forgetting `await` gives you a Pending object that stringifies to `[object Promise]` in your config.
- **URL format.** The vault URL must look like `https://YOUR-VAULT.vault.azure.net/` with the `.vault.azure.net` suffix required. A regional suffix typo gives DNS failures, not auth errors.
Verify: same-identity CLI check (`az keyvault secret show`) before debugging code.