secretspec (Python SDK)

Python bindings for SecretSpec, a declarative secrets manager. This package is a thin client over a pyo3 extension that calls secretspec::resolve_json directly: resolution (providers, chains, profiles, generation, as_path) happens in the Rust core, so the SDK inherits every provider with no Python-side logic.

from secretspec import SecretSpec

resolved = (
    SecretSpec.builder()
    .with_provider("keyring://")
    .with_profile("production")
    .with_reason("boot web app")
    .load()
)

print(resolved.provider, resolved.profile)
db = resolved.secrets["DATABASE_URL"]
print(db.get)              # the value, or the file path for as_path secrets
resolved.set_as_env()      # export everything into os.environ

A missing required secret raises MissingRequiredError; any other failure raises SecretSpecError (with a stable .kind).

Scopes (0.17+)

Use .with_scope("api") to resolve only a named [scopes.api] subset. Both resolved.scope and report.scope return the selected scope:

resolved = SecretSpec.builder().with_scope("api").load()

Cleanup

as_path secrets are materialized to temp files that outlive the call. Use the result as a context manager (with SecretSpec.builder()...load() as resolved:) or call resolved.close() when done so the secret files do not accumulate.

Value-free report

report() returns the inventory/preflight view: per-secret status and provenance, never a value. Unlike load(), it does not raise when a required secret is missing — it appears as a SecretReport with status "missing_required".

report = SecretSpec.builder().with_profile("production").report()
for s in report.secrets:
    print(s.name, s.status, s.required)

Native library

The Rust resolver is statically linked into a compiled pyo3 extension (secretspec._native, built from the secretspec-py-native crate) inside the installed wheel, so there is nothing to locate at runtime. The prebuilt abi3 wheels are self-contained (pip install secretspec). From a source checkout the extension is built on demand by the test harness via maturin develop, which needs maturin and a Rust toolchain on PATH.

Project links

Data verified by PyPI on Jul 27, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.19.1)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for iElectric from gravatar.com iElectric

GitHub Statistics

Data verified by PyPI on Jul 27, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache-2.0

Requires

Python >=3.9

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

secretspec-0.17.0-cp39-abi3-win_amd64.whl (10.0 MB view details)

Uploaded CPython 3.9+Windows x86-64

secretspec-0.17.0-cp39-abi3-manylinux_2_28_x86_64.whl (14.7 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ x86-64

secretspec-0.17.0-cp39-abi3-manylinux_2_28_aarch64.whl (14.7 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ ARM64

secretspec-0.17.0-cp39-abi3-macosx_11_0_arm64.whl (11.2 MB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

File details

Details for the file secretspec-0.17.0-cp39-abi3-win_amd64.whl.

File metadata

  • Download URL: secretspec-0.17.0-cp39-abi3-win_amd64.whl
  • Upload date:
  • Size: 10.0 MB
  • Tags: CPython 3.9+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for secretspec-0.17.0-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 0ce84f8d13b1215e393548a9823a8d211791bf1dfbec6b55acb0456f52f7bee1
MD5 dfd0f3977d09386c5a0257eef9b53e9f
BLAKE2b-256 d6946e9d88eae1546cd9b035167e09ec40193d9ee406deca261258704f6eeecc

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.17.0-cp39-abi3-win_amd64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file secretspec-0.17.0-cp39-abi3-manylinux_2_28_x86_64.whl.

File metadata

File hashes

Hashes for secretspec-0.17.0-cp39-abi3-manylinux_2_28_x86_64.whl
Algorithm Hash digest
SHA256 e0f3a4aabbc424a82b5dc7a6541d4318eddcb42bed1e86dc52831991e8a6aa62
MD5 2c9e347d577397015df55097ea91d341
BLAKE2b-256 231262be0910323cf6c397e526050a9a679e0c482422d99176a08f4ee3654ce4

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.17.0-cp39-abi3-manylinux_2_28_x86_64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file secretspec-0.17.0-cp39-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for secretspec-0.17.0-cp39-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 1875609d75de57f0e3e94a2b72c03c3d68bc880031345abf71a8cb110b6ff5ed
MD5 357de628dc9e9d864eee6ae6ebf10067
BLAKE2b-256 fb80c9092194500190e045c855895066f301a7ea6f326d30f25af3125801e6dc

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.17.0-cp39-abi3-manylinux_2_28_aarch64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file secretspec-0.17.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for secretspec-0.17.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 ac419750b59bf4fe29f5f56211e96b5440118276de65fca1c02ccbd10ae9217f
MD5 3d4a54455ffd0ed48ce6015392916712
BLAKE2b-256 b153463eb1997a10f52d69fde3f77c415b52cc34374135d8ba987dc59b2b8ed6

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.17.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page