Secrets

bladekit.Secret

A Secret is a reference by name — the SDK object never holds a value. It is passed to secrets= on @app.function or @app.cls and resolved by the control plane at run creation, and again at scheduling.

bladekit.Secret.from_name(name: str) -> Secret

name str

Name of an existing secret to reference. Must match ^[a-z0-9][a-z0-9._-]{0,63}$; raises InvalidArgumentError otherwise.

Injecting secrets into functions and classes

Pass a list of bladekit.Secret objects as secrets= to @app.function or @app.cls. Each key stored in the secret becomes an environment variable inside the container — the variable names come from whatever keys were set with blade secret set (independent of the secret's own name). On @app.cls, secrets= is declared once on the class and forwarded to every method's underlying function.

import os
import bladekit

app = bladekit.app("my-app")

@app.function(gpu="RTX-A4500", image=bladekit.Image.from_catalog("fabric/torch"),
              secrets=[bladekit.Secret.from_name("hf-token")])
def embed(text: str):
    token = os.environ["HF_TOKEN"]  # key set via `blade secret set hf-token --from-env HF_TOKEN`
    ...

blade secret set

Create or replace a secret's values. Values are never accepted as a positional argument — that would leak them into ps output and shell history — so they come either from named environment variables via --from-env, or from stdin as KEY=VALUE lines (one per line; blank lines and #-prefixed lines are ignored).

blade secret set NAME [--from-env KEY ...]

name str

Secret name to create or replace (positional argument).

--from-env list[str]Default: None

Repeatable. Read the value for KEY from the local environment (--from-env HF_TOKEN --from-env OTHER_KEY). If omitted, values are read from stdin as KEY=VALUE lines instead.

HF_TOKEN=hf_xxx blade secret set hf-token --from-env HF_TOKEN

printf "HF_TOKEN=hf_xxx\nOTHER=value\n" | blade secret set hf-token

blade secret list

Lists secrets as a table of secret_id, name, env_keys (the key names stored in the secret, comma-separated) and updated. Values are never shown.

blade secret list

blade secret rm

Deletes a secret, looked up by name or by its scr_... id.

blade secret rm NAME

name str

Secret name, or its scr_... id. An id skips the name lookup; a bare name raises SECRET_NOT_FOUND if no secret with that name exists.

Naming rules and scoping

Secret names must match ^[a-z0-9][a-z0-9._-]{0,63}$ — lowercase alphanumerics, ., _ and -, starting with an alphanumeric, up to 64 characters. Both Secret.from_name and the control plane enforce this pattern.

Related reference