murk-secrets

PyPI

Python bindings for murk — an encrypted secrets manager for developers.

murk stores encrypted secrets in a single .murk file safe to commit to git. This package lets Python apps read those secrets at runtime.

Prerequisites

You need the murk CLI to create and manage vaults. This package only reads them.

# Install the CLI first
brew tap iicky/murk && brew install murk

# Initialize a vault and add secrets
murk init
murk add DATABASE_URL
murk add API_KEY

Then add the Python package to your project:

pip install murk-secrets

Quick start

# Load your key (created by murk init)
source .env

import murk

# Load the vault (reads MURK_KEY from environment)
vault = murk.load()

# Get a single secret
db_url = vault.get("DATABASE_URL")

# Get all secrets as a dict
secrets = vault.export()

# Dict-style access
api_key = vault["API_KEY"]

API

murk.load(vault_path=".murk") -> Vault

Load and decrypt a murk vault. Reads MURK_KEY or MURK_KEY_FILE from the environment.

murk.get(key, vault_path=".murk") -> str | None

One-liner: load the vault and get a single value.

murk.export_all(vault_path=".murk") -> dict[str, str]

One-liner: load the vault and export all secrets as a dict.

murk.has_key() -> bool

Check if a MURK_KEY is available in the environment.

Vault

Method Returns Description
vault.get(key) str | None Get a single decrypted value
vault.export() dict[str, str] All secrets as a dict
vault.keys() list[str] List of key names
vault[key] str Dict-style access (raises on missing key)
key in vault bool Check if a key exists
len(vault) int Number of secrets

Scoped (per-user) overrides are applied automatically — if you have a scoped value for a key, it takes priority over the shared value.

Agent policy

When the loaded key is an agent grant (minted with murk agent grant), the vault's agent policy is enforced on read, the same way the CLI enforces it at murk agent exec: get() and export() raise RuntimeError if the policy forbids a key. Operator keys are unaffected. This makes a policy vault strict from every entry point — though an agent already cannot decrypt out-of-scope secrets at all, since its ephemeral key is not a recipient of them.

Environment

Set one of:

  • MURK_KEY — your age secret key directly
  • MURK_KEY_FILE — path to your key file (created by murk init)

The easiest setup is source .env in your project directory after running murk init.

Requirements

  • Python >= 3.9
  • murk CLI installed (to create and manage vaults)
  • A .murk vault file in your project (created with murk init)
  • MURK_KEY or MURK_KEY_FILE in the environment (created by murk init, loaded via source .env)

License

MIT OR Apache-2.0

Project links

Data verified by PyPI on Jul 16, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.11.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for iicky from gravatar.com iicky

GitHub Statistics

Data verified by PyPI on Jul 16, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License, MIT License (MIT OR Apache-2.0)

Requires

Python >=3.9

Tags

secrets encryption age dotenv security

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

murk_secrets-0.9.1.tar.gz (5.2 MB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

murk_secrets-0.9.1-cp39-abi3-win_amd64.whl (1.0 MB view details)

Uploaded CPython 3.9+Windows x86-64

murk_secrets-0.9.1-cp39-abi3-manylinux_2_28_aarch64.whl (1.2 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ ARM64

murk_secrets-0.9.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (1.3 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

murk_secrets-0.9.1-cp39-abi3-macosx_11_0_arm64.whl (1.1 MB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

murk_secrets-0.9.1-cp39-abi3-macosx_10_12_x86_64.whl (1.2 MB view details)

Uploaded CPython 3.9+macOS 10.12+ x86-64

File details

Details for the file murk_secrets-0.9.1.tar.gz.

File metadata

  • Download URL: murk_secrets-0.9.1.tar.gz
  • Upload date:
  • Size: 5.2 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for murk_secrets-0.9.1.tar.gz
Algorithm Hash digest
SHA256 88bc551b5aa6c23d4ed9b8413f65e5009516e1d78007effc8835e6c3bb8ad3f9
MD5 aba257620dbc0f1613d05bd12e4b38af
BLAKE2b-256 cc942e23678ed78d12949a335a537ea538b1ad50c64a88cb6914c267a8a88bbd

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.1.tar.gz:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.1-cp39-abi3-win_amd64.whl.

File metadata

  • Download URL: murk_secrets-0.9.1-cp39-abi3-win_amd64.whl
  • Upload date:
  • Size: 1.0 MB
  • Tags: CPython 3.9+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for murk_secrets-0.9.1-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 ec14dcf6c34320b8720dc882e6168c8f754c03ce1fa820595bf25bb1ce435f67
MD5 54377a4bfa7c68e10d168811f5d514b0
BLAKE2b-256 7b4f69f09dd5727e7f57b3ec8d693805737d1eabc891f97b3822ef36797f4e0f

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.1-cp39-abi3-win_amd64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.1-cp39-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.1-cp39-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 8a2b5e7b9607d30b3564fcb40e752bbbcd6b29437f8d8ba0a7ef0bbce1ee7be9
MD5 a1b5535ae3d1e524f7cd39a328cc3bfd
BLAKE2b-256 edd6b97f8b67114681d4d6f6045dbd1316cfb468da4ecfd49c476e7dc8d8fb37

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.1-cp39-abi3-manylinux_2_28_aarch64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 3e508aa386c770915214e4239ef5eac9d9ec7f19031f4b1499d86bc8f07ebbf0
MD5 769343dc706b082c9927d5072093bc5b
BLAKE2b-256 637873da591b8fc1e81d774309598b57346f99d9a38ce1eaa753def142ee7467

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.1-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.1-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 8e06a7e5853e1eed40e335b6784ee098bd12db151f63e43a5ad54ab727a453ca
MD5 2671ca431a1541ba78063128f47de56a
BLAKE2b-256 5b0dab06953757b2c377d72561467f499a11d61ea89fefffcc2436dadcce84b2

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.1-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.1-cp39-abi3-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.1-cp39-abi3-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 8c6eeca15390fc0d4ec4beb3fc4dfc584ed351b2bc4865135615c4e98d079421
MD5 905408d36608e58e4a295660a8cbed23
BLAKE2b-256 e848064e4c5064f74e5779889bf7eafaed118552aa84c2d13910f0ac91761b55

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.1-cp39-abi3-macosx_10_12_x86_64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.11.0

6 files

0.10.3

6 files

0.10.2

6 files

0.10.1

6 files

0.10.0

6 files

This release

0.9.1 This release

6 files

0.9.0

6 files

0.8.0

6 files

0.7.0

6 files

0.6.2

6 files

0.6.1

6 files

0.6.0

6 files

0.5.11

6 files

0.5.10

6 files

0.5.9

6 files

0.5.8

6 files

0.5.7

6 files

0.5.6

6 files

0.5.5

6 files

0.5.4

6 files

0.5.3

6 files

0.5.1

6 files

0.5.0

6 files

0.4.1

6 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page