Secrets

Declare a credential dependency

Save this as service.py:

import os
import urllib.request

from lazycloud import App, Secret

app = App("service_client")
api_key = Secret("SERVICE_API_KEY")


@app.function(secrets=[api_key.name], retries=0)
def fetch_status(url: str) -> str:
    request = urllib.request.Request(
        url,
        headers={"Authorization": f"Bearer {os.environ[api_key.name]}"},
    )
    with urllib.request.urlopen(request, timeout=30) as response:
        return response.read().decode("utf-8")

Secret("SERVICE_API_KEY") only names the secret, and only workloads that list it receive the value, as an environment variable. The name lives in code, the value never does.

Provision the value from Python

Save this as configure_secrets.py beside service.py:

from getpass import getpass

from service import api_key

if __name__ == "__main__":
    api_key.set(getpass("Service API key: "))

Run it once to store the key:

uv run python configure_secrets.py

set() creates or replaces the value. In CI, the same script can call api_key.set(os.environ["SERVICE_API_KEY"]) with the value from the CI secret store. With SERVICE_URL set to your API’s URL, the function runs:

uv run lazycloud run service:fetch_status "$SERVICE_URL"

Secrets are encrypted at rest and scoped to the workspace. Code can still leak one by printing it, and the record set() returns contains the value.

Rotate or remove a secret

Rotation is the setup script with a new value, then a redeploy so new containers get it. create(value) refuses to overwrite, update(), get(), and delete() do the rest, and a secret stays stored until deleted. Image.with_secrets([...]) covers build-time credentials.

From the CLI or dashboard

The secret commands and the dashboard’s Storage page manage secrets too.

Getting started

Core concepts

CLI reference

Examples

Account

Declare a credential dependency

Provision the value from Python

Rotate or remove a secret

From the CLI or dashboard

​Declare a credential dependency

​Provision the value from Python

​Rotate or remove a secret

​From the CLI or dashboard

Declare a credential dependency

Provision the value from Python

Rotate or remove a secret

From the CLI or dashboard