secretspec (Python SDK)

Python bindings for SecretSpec, a declarative secrets manager. This package is a thin client over a pyo3 extension that calls secretspec::resolve_json directly: resolution (providers, chains, profiles, generation, as_path) happens in the Rust core, so the SDK inherits every provider with no Python-side logic.

from secretspec import SecretSpec

resolved = (
    SecretSpec.builder()
    .with_provider("keyring://")
    .with_profile("production")
    .with_reason("boot web app")
    .load()
)

print(resolved.provider, resolved.profile)
db = resolved.secrets["DATABASE_URL"]
print(db.get)              # the value, or the file path for as_path secrets
resolved.set_as_env()      # export everything into os.environ

A missing required secret raises MissingRequiredError; any other failure raises SecretSpecError (with a stable .kind).

Cleanup

as_path secrets are materialized to temp files that outlive the call. Use the result as a context manager (with SecretSpec.builder()...load() as resolved:) or call resolved.close() when done so the secret files do not accumulate.

Value-free report

report() returns the inventory/preflight view: per-secret status and provenance, never a value. Unlike load(), it does not raise when a required secret is missing — it appears as a SecretReport with status "missing_required".

report = SecretSpec.builder().with_profile("production").report()
for s in report.secrets:
    print(s.name, s.status, s.required)

Native library

The Rust resolver is statically linked into a compiled pyo3 extension (secretspec._native, built from the secretspec-py-native crate) inside the installed wheel, so there is nothing to locate at runtime. The prebuilt abi3 wheels are self-contained (pip install secretspec). From a source checkout the extension is built on demand by the test harness via maturin develop, which needs maturin and a Rust toolchain on PATH.

Project links

Data verified by PyPI on Jul 16, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.19.1)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for iElectric from gravatar.com iElectric

GitHub Statistics

Data verified by PyPI on Jul 16, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache-2.0

Requires

Python >=3.9

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

secretspec-0.15.0-cp39-abi3-manylinux_2_28_x86_64.whl (15.2 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ x86-64

secretspec-0.15.0-cp39-abi3-manylinux_2_28_aarch64.whl (14.9 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ ARM64

secretspec-0.15.0-cp39-abi3-macosx_11_0_arm64.whl (11.3 MB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

File details

Details for the file secretspec-0.15.0-cp39-abi3-manylinux_2_28_x86_64.whl.

File metadata

File hashes

Hashes for secretspec-0.15.0-cp39-abi3-manylinux_2_28_x86_64.whl
Algorithm Hash digest
SHA256 b18e5fccb1bd5eeedb484d0ec38cf03b561794961d0c5530c566e89e01761bcb
MD5 069e924f1fe0f0aed545cd635827fbf4
BLAKE2b-256 decc7e86404baed132c365c66fda65773c2ff6bd9d04402680782cd1b3f76e47

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.15.0-cp39-abi3-manylinux_2_28_x86_64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file secretspec-0.15.0-cp39-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for secretspec-0.15.0-cp39-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 d951fb5125dd051a9cd37e8c8aa9f07d1977c6dfc3efa228ec7e94d38ba8ddda
MD5 3fb04bf53739147e4f6ac338bbcdb621
BLAKE2b-256 3ee0b19b972b954c7eb3d8b57892dafbfdba040396ab643fc6e891c5a3e7d019

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.15.0-cp39-abi3-manylinux_2_28_aarch64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file secretspec-0.15.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for secretspec-0.15.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 d48386734674cdba904a07dd3e91777ef604aa1cae025d57613410954d3607f9
MD5 6deb0f163aa45e7eefd440eab355b30d
BLAKE2b-256 4dbd646c4c3b6509a17619abe747deb84e5605fef638781abbb1d975f5c2fd09

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.15.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page