Azure Key Vault secrets in Node.js: SecretClient with @azure/identity

TL;DR

This is the number one Key Vault failure across languages. - Two packages. @azure/key-vault-secrets and @azure/identity are separate installs. The vault URL must look like https://YOUR-VAULT.vault.azure.net/ with the.vault.azure.net suffix required.

Steps

1. ```js

import { SecretClient } from "@azure/key-vault-secrets"; import { DefaultAzureCredential } from "@azure/identity";

const client = new SecretClient( "https://YOUR-VAULT.vault.azure.net/", new DefaultAzureCredential() ); const secret value await client.getSecret("[secret-name]");

2. Traps, same family as Python:

3. - **Permission model.** RBAC ("Key Vault Secrets User") vs access policies. 403 = wrong model or missing grant. This is the number one Key Vault failure across languages.
- **Two packages.** `@azure/key-vault-secrets` and `@azure/identity` are separate installs. The number of broken builds from importing DefaultAzureCredential from the wrong package is embarrassing; check imports.
- **Async everywhere.** Every client method returns a promise. Forgetting `await` gives you a Pending object that stringifies to `[object Promise]` in your config.
- **URL format.** The vault URL must look like `https://YOUR-VAULT.vault.azure.net/` with the `.vault.azure.net` suffix required. A regional suffix typo gives DNS failures, not auth errors.

4. Verify: same-identity CLI check (`az keyvault secret show`) before debugging code.

## When to use

You are seeing this: ``js import { SecretClient } from "@azure/key-vault-secrets"; import { DefaultAzureCredential } from "@azure/identity"; const client = new SecretClient( "https://YOUR-VAULT.vault.azure.net/", new DefaultAzureCredential() ); const secret value await... Use this skill when you run into "Azure Key Vault secrets in Node.js: SecretClient with @azure/identity".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

## Sources

- https://YOUR-VAULT.vault.azure.net/"

- https://YOUR-VAULT.vault.azure.net/`

Proactive skill. Node quickstart pattern verified against current docs. Evidence: https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-node