defineConfig(), pick a storage backend, and TypeScript infers all your value types automatically — no manual casting, no any.
Sensitive fields like passwords and API tokens are declared with keyring() and stored in the OS keyring (Windows Credential Manager, macOS Keychain, or Linux Secret Service). They never touch disk.
Key features
| Feature | Description |
|---|---|
| Type-safe schemas | defineConfig() gives full TypeScript inference — value types are inferred automatically, no casting required |
| OS keyring integration | Mark sensitive fields with keyring() — secrets are stored in the platform keyring and never written to disk |
| Multiple storage backends | Choose JSON, YAML, TOML, encrypted Binary (XChaCha20-Poly1305 + optional Argon2id KDF), or SQLite |
| Fluent builder API | Chainable .lock(), .unlock(), .createIfMissing() on every operation |
| Batch operations | loadAll / saveAll / patchAll complete in a single IPC round-trip |
| File watching | React to external changes or in-app events with watchExternal and onChange |
| Export and import | Convert configs between JSON, YAML, and TOML formats on the fly |
| Dry-run validation | validate() / validatePartial() check data against the schema without writing to storage |
| Rolling backups | backup: true keeps up to 3 backup copies before each write, auto-deleted on app exit |
| Config diff | configDiff() computes structural differences between two config objects |
How it works
You describe your configuration withdefineConfig(), passing a plain object where keys map to type constructors (String, Number, Boolean) or nested schema objects. The keyring() helper marks a field as secret; optional() marks a field as not required.
At runtime, a Configurate instance ties a schema to a file name, a base directory, and a provider. The provider controls the on-disk format. Operations (create, load, save, patch, delete) are built through a chainable API and executed with .run().
When a config contains keyring fields, you call .lock(keyringOpts) to write secrets to the OS keyring on save and .unlock(keyringOpts) to read them back on load. Loading without .unlock() returns null for all keyring-protected fields.
Get started
Quickstart
Get a working config up and running in minutes with a copy-paste example
Installation
Full setup instructions for the Rust crate and the TypeScript package