secretspec (Python SDK)

Python bindings for SecretSpec, a declarative secrets manager. This package is a thin client over a pyo3 extension that calls secretspec::resolve_json directly: resolution (providers, chains, profiles, generation, as_path) happens in the Rust core, so the SDK inherits every provider with no Python-side logic.

from secretspec import SecretSpec

resolved = (
    SecretSpec.builder()
    .with_provider("keyring://")
    .with_profile("production")
    .with_reason("boot web app")
    .load()
)

print(resolved.provider, resolved.profile)
db = resolved.secrets["DATABASE_URL"]
print(db.get)              # the value, or the file path for as_path secrets
resolved.set_as_env()      # export everything into os.environ

A missing required secret raises MissingRequiredError; any other failure raises SecretSpecError (with a stable .kind).

Cleanup

as_path secrets are materialized to temp files that outlive the call. Use the result as a context manager (with SecretSpec.builder()...load() as resolved:) or call resolved.close() when done so the secret files do not accumulate.

Value-free report

report() returns the inventory/preflight view: per-secret status and provenance, never a value. Unlike load(), it does not raise when a required secret is missing — it appears as a SecretReport with status "missing_required".

report = SecretSpec.builder().with_profile("production").report()
for s in report.secrets:
    print(s.name, s.status, s.required)

Native library

The Rust resolver is statically linked into a compiled pyo3 extension (secretspec._native, built from the secretspec-py-native crate) inside the installed wheel, so there is nothing to locate at runtime. The prebuilt abi3 wheels are self-contained (pip install secretspec). From a source checkout the extension is built on demand by the test harness via maturin develop, which needs maturin and a Rust toolchain on PATH.

Project links

Data verified by PyPI on Jul 9, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.19.1)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for iElectric from gravatar.com iElectric

GitHub Statistics

Data verified by PyPI on Jul 9, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache-2.0

Requires

Python >=3.9

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

secretspec-0.14.0-cp39-abi3-manylinux_2_28_x86_64.whl (14.6 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ x86-64

secretspec-0.14.0-cp39-abi3-manylinux_2_28_aarch64.whl (14.3 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ ARM64

secretspec-0.14.0-cp39-abi3-macosx_11_0_arm64.whl (10.8 MB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

File details

Details for the file secretspec-0.14.0-cp39-abi3-manylinux_2_28_x86_64.whl.

File metadata

File hashes

Hashes for secretspec-0.14.0-cp39-abi3-manylinux_2_28_x86_64.whl
Algorithm Hash digest
SHA256 4f3f71fdbcb014a7e285646c85e31f995104c014d3c178d3bf5a1ba823a8edf8
MD5 86a50604391e00dec6dce06faa12a928
BLAKE2b-256 1a44a94a5600b0be46d08f8ade715f2cfb0429c5a66be2c97459a2599499f5d7

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.14.0-cp39-abi3-manylinux_2_28_x86_64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file secretspec-0.14.0-cp39-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for secretspec-0.14.0-cp39-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 c8aeedfb2fdc149f1d5f97a45c61fcd598c2d444f529ab227af9ac2e3f608dbd
MD5 f031be10f613365b0a99da73943fce82
BLAKE2b-256 c49ca57b8853c2a3b42132329b311354e0e6c50399f4d88bb677c1c915f73a7d

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.14.0-cp39-abi3-manylinux_2_28_aarch64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file secretspec-0.14.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for secretspec-0.14.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 9820e7140f7047132541591e9db584c7ddbbc80fae0eb48c61b50d5283e1fdf2
MD5 e09299abd00f5f9fb0362dcf4fae8c51
BLAKE2b-256 5ac86d989c327e8b62fa273d30242bba7cf2b3c5c85b75d93752a902141171b3

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.14.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page