code: func New(ctx context.Context, alias string, url *backend.URL, cfgdir string, agent *client.Client) (*Store, error) {
  	cfg := &api.Config{
  		Address: fmt.Sprintf("%s://%s:%s", url.Scheme, url.Host, url.Port),
  	}
  	// configure TLS, if necessary
  	if err := configureTLS(url.Query, cfg); err != nil {
  		return nil, err
  	}
  
  	client, err := api.NewClient(cfg)
  	if err != nil {
  		return nil, err
  	}
  
  	s := &Store{
  		api:    client,
  		alias:  alias,
  		url:    url,
  		path:   url.Path,
  		cfgdir: cfgdir,
  	}
  
  	token := url.Query.Get("token")
  	key := fmt.Sprintf("vault-%s-%s", alias, url.String())
  	if token == "" {
  		out.Debug(ctx, "Requesting token from secrets config: %s", key)
  		t, err := s.loadSecret(ctx, key)
  		if err != nil {
  			return nil, errors.Wrapf(err, "failed to load token from secrets config: %s", err)
  		}
  		out.Debug(ctx, "Got token from secrets config: '%s'", t)
  		token = t
  	}
  	out.Debug(ctx, "Vault-Token: '%s'", token)
  
  	s.api.SetToken(token)
  
  	// test connection and save token if it works
  	if _, err := s.List(ctx, ""); err != nil {
  		out.Debug(ctx, "Vault access not working. removing saved token")
  		_ = s.eraseSecret
  		return nil, err
  	}
  	out.Debug(ctx, "Vault access OK. saving token")
  	if err := s.storeSecret(ctx, key, token); err != nil {
  		return nil, err
  	}
  
  	return s, nil
  }
docs: // New creates a new store