Secrets

Demo: secrets

Source: demo/secrets/app.py in the repository.

API keys and passwords stored on the platform, injected into containers as environment variables. Code, blueprints and logs never contain the value.

cd demo/secrets

# create the secret once
levers9 secret create DEMO_API_KEY "sk-demo-123"

# run: the function lists secrets=["DEMO_API_KEY"] and reads os.environ["DEMO_API_KEY"]
python app.py
# {"ok": true, "key_seen": "sk-…123", "length": 11}

# manage
levers9 secret list
levers9 secret show DEMO_API_KEY
levers9 secret modify DEMO_API_KEY "sk-demo-456"
levers9 secret delete DEMO_API_KEY

Notes

• Every abstraction takes secrets=[...]: jobs, endpoints, queues, crons, boxes, notebooks.
• Secrets are per workspace. The dashboard’s Secrets page creates and rotates them too; notebooks get them the same way (see the Getting started notebook).
• Never print a secret in a function; logs are stored.
• levers9 secret show needs a workspace token. A restricted token, like the one a container on a private pool carries, isn’t allowed to read a secret’s value back; code reads it from its environment instead.