Azure Key Vault secrets in Node.js: SecretClient with @azure/identity

import { SecretClient } from "@azure/key-vault-secrets";
import { DefaultAzureCredential } from "@azure/identity";

const client = new SecretClient(
  "https://YOUR-VAULT.vault.azure.net/",
  new DefaultAzureCredential()
);
const secret value await client.getSecret("[secret-name]");

Traps, same family as Python:

• Permission model. RBAC ("Key Vault Secrets User") vs access policies. 403 = wrong model or missing grant. This is the number one Key Vault failure across languages.
• Two packages. @azure/key-vault-secrets and @azure/identity are separate installs. The number of broken builds from importing DefaultAzureCredential from the wrong package is embarrassing; check imports.
• Async everywhere. Every client method returns a promise. Forgetting await gives you a Pending object that stringifies to [object Promise] in your config.
• URL format. The vault URL must look like https://YOUR-VAULT.vault.azure.net/ with the .vault.azure.net suffix required. A regional suffix typo gives DNS failures, not auth errors.

Verify: same-identity CLI check (az keyvault secret show) before debugging code.