hanzo-kms 1.1.0

Hanzo KMS SDK - Secret management for Python

Hanzo KMS - Python SDK

Official Python SDK for Hanzo KMS - Secret management for your applications.

Installation

pip install hanzo-kms

Or with uv:

uv add hanzo-kms

Quick Start

from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, UniversalAuthMethod

# Initialize client
client = KMSClient(ClientSettings(
    site_url="https://kms.hanzo.ai",
    auth=AuthenticationOptions(
        universal_auth=UniversalAuthMethod(
            client_id="your-client-id",
            client_secret="your-client-secret",
        )
    )
))

# List all secrets
secrets = client.list_secrets(
    project_id="my-project",
    environment="production"
)

for secret in secrets:
    print(f"{secret.secret_key}: {secret.secret_value}")

# Get a specific secret
db_url = client.get_value(
    project_id="my-project",
    environment="production",
    secret_name="DATABASE_URL"
)

# Inject all secrets into environment
client.inject_env(
    project_id="my-project",
    environment="production"
)

Environment Variables

The client can be configured via environment variables:

export HANZO_KMS_URL="https://kms.hanzo.ai"
export HANZO_KMS_CLIENT_ID="your-client-id"
export HANZO_KMS_CLIENT_SECRET="your-client-secret"

Then simply:

from hanzo_kms import KMSClient

client = KMSClient()  # Uses environment variables
secrets = client.list_secrets("my-project", "production")

Authentication Methods

Universal Auth (Recommended)

from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, UniversalAuthMethod

client = KMSClient(ClientSettings(
    auth=AuthenticationOptions(
        universal_auth=UniversalAuthMethod(
            client_id="...",
            client_secret="...",
        )
    )
))

Kubernetes Auth

For workloads running in Kubernetes:

from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, KubernetesAuthMethod

client = KMSClient(ClientSettings(
    auth=AuthenticationOptions(
        kubernetes=KubernetesAuthMethod(
            identity_id="your-identity-id",
            # Uses default service account token path
        )
    )
))

AWS IAM Auth

from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, AWSIamAuthMethod

client = KMSClient(ClientSettings(
    auth=AuthenticationOptions(
        aws_iam=AWSIamAuthMethod(
            identity_id="your-identity-id",
        )
    )
))

API Reference

KMSClient

Method	Description
list_secrets(project_id, environment, path="/")	List all secrets
get_secret(project_id, environment, secret_name)	Get a single secret
get_value(project_id, environment, secret_name, default=None)	Get just the value
create_secret(project_id, environment, secret_name, secret_value)	Create a secret
update_secret(project_id, environment, secret_name, secret_value)	Update a secret
delete_secret(project_id, environment, secret_name)	Delete a secret
inject_env(project_id, environment, overwrite=False)	Inject into os.environ

Compatibility

This SDK is compatible with:

• Hanzo KMS (https://kms.hanzo.ai)
• Lux KMS (https://kms.lux.network)
• Infisical (https://infisical.com)

The InfisicalClient alias is provided for drop-in compatibility:

from hanzo_kms import InfisicalClient  # Same as KMSClient

License

MIT License - see LICENSE for details.