seal.zone/go
The Go SDK: seal secrets and use them from Go without ever holding them. It verifies the enclave before it sends anything.
Install
go get seal.zone/go
Needs cgo. Prebuilt for Linux and macOS, amd64 and arm64.
Use
client, err := seal.FromEnv(ctx) // SEAL_ENDPOINT, SEAL_TENANT, the workload's identity
s, err := client.Session(ctx, blob) // the app gets a stand-in key
defer s.Close(ctx)
req, _ := http.NewRequest("GET", s.URL()+"/models", nil)
req.Header.Set("Authorization", "Bearer "+s.Key()) // the enclave injects the real one