---
title: "Secret"
hideTitleOnPage: true
---

## SecretService

```python
class SecretService()
```

Project secret namespace.

#### SecretService.\_\_init\_\_

```python
def __init__(impl: AsyncSecretService, bridge: SyncBridge) -> None
```

#### SecretService.delete

```python
def delete(name: str) -> None
```

Delete a secret.

#### SecretService.get

```python
def get(name: str) -> SecretMeta
```

Fetch one secret's metadata (never its value).

#### SecretService.iter

```python
def iter(*,
         cursor: Optional[str] = None,
         limit: Optional[int] = None) -> Iterator[SecretDto]
```

#### SecretService.list

```python
def list(*,
         cursor: Optional[str] = None,
         limit: Optional[int] = None) -> ListResult[SecretDto]
```

List secret metadata.

#### SecretService.set

```python
def set(name: str,
        value: str,
        *,
        allowed_domains: Sequence[str],
        description: Optional[str] = None,
        if_not_exists: bool = False) -> SecretMeta
```

Create or update a write-only secret.

## AsyncSecretService

```python
class AsyncSecretService()
```

Project secret namespace.

Project-scoped secrets (PLAN-SECRETS.md): named key/value pairs stored
encrypted in the project. Attach one or more to a sandbox at creation via
the `secrets` create parameter (a list of names); the sandbox receives an
opaque per-VM PLACEHOLDER as an environment variable, and the platform's
egress proxy substitutes the real value into outbound HTTPS requests (a
plain `http://` request carries the placeholder unchanged). The real
value NEVER enters the sandbox and is never returned by the API
(write-only).

#### AsyncSecretService.\_\_init\_\_

```python
def __init__(transport: AsyncTransport) -> None
```

#### AsyncSecretService.list

```python
async def list(*,
               cursor: Optional[str] = None,
               limit: Optional[int] = None) -> ListResult[SecretDto]
```

List secret metadata.

#### AsyncSecretService.iter

```python
async def iter(*,
               cursor: Optional[str] = None,
               limit: Optional[int] = None) -> AsyncIterator[SecretDto]
```

#### AsyncSecretService.get

```python
async def get(name: str) -> SecretMeta
```

Fetch one secret's metadata (never its value).

#### AsyncSecretService.set

```python
async def set(name: str,
              value: str,
              *,
              allowed_domains: Sequence[str],
              description: Optional[str] = None,
              if_not_exists: bool = False) -> SecretMeta
```

Create or update a write-only secret.

`allowed_domains`: The hosts where this secret's value may be sent
(exact or `*.` wildcard), or `["*"]` for any verified host.
`"*"` lets the value reach any HTTPS host, including one a
compromised sandbox controls.

#### AsyncSecretService.delete

```python
async def delete(name: str) -> None
```

Delete a secret.

## SecretDto

```python
SecretDto = _gen.api.Secret
```

## SecretMeta

```python
SecretMeta = _gen.api.Secret
```