Start with a server-side application that can securely obtain an Identity token. Do not put that token in a public browser bundle.

1. Obtain authorized access to the private @ghoststack/vault-client package registry.
2. Have the operator confirm the REST audience and least required scope, workspace and record permission.
3. Create a client with createVaultClient({ baseUrl, tokenSource }) as shown in the SDK guide.
4. Call whoami() and listCredentials() to check metadata before reading a secret.
5. Lease a fictional test credential with a run ID and justification, then redeem the returned handle once.
6. Confirm that the application extracts the intended typed field without printing the response and that Vault records the event.

The older @ghoststack/vault-sdk and Vault.connect() examples do not describe the current client. Use the current method reference. No code sample in this documentation supplies credentials or authorizes a real production read.

Screen reference

Open this screenshot at full size.