secretspec (Python SDK)

Python bindings for SecretSpec, a declarative secrets manager. This package is a thin client over a pyo3 extension that calls secretspec::resolve_json directly: resolution (providers, chains, profiles, generation, as_path) happens in the Rust core, so the SDK inherits every provider with no Python-side logic.

from secretspec import SecretSpec

resolved = (
    SecretSpec.builder()
    .with_provider("keyring://")
    .with_profile("production")
    .with_reason("boot web app")
    .load()
)

print(resolved.provider, resolved.profile)
db = resolved.secrets["DATABASE_URL"]
print(db.get)              # the value, or the file path for as_path secrets
resolved.set_as_env()      # export everything into os.environ

A missing required secret raises MissingRequiredError; any other failure raises SecretSpecError (with a stable .kind).

Scopes (0.17+)

Use .with_scope("api") to resolve only a named [scopes.api] subset. Both resolved.scope and report.scope return the selected scope:

resolved = SecretSpec.builder().with_scope("api").load()

Cleanup

as_path secrets are materialized to temp files that outlive the call. Use the result as a context manager (with SecretSpec.builder()...load() as resolved:) or call resolved.close() when done so the secret files do not accumulate.

Value-free report

report() returns the inventory/preflight view: per-secret status and provenance, never a value. Unlike load(), it does not raise when a required secret is missing — it appears as a SecretReport with status "missing_required".

report = SecretSpec.builder().with_profile("production").report()
for s in report.secrets:
    print(s.name, s.status, s.required)

Native library

The Rust resolver is statically linked into a compiled pyo3 extension (secretspec._native, built from the secretspec-py-native crate) inside the installed wheel, so there is nothing to locate at runtime. The prebuilt abi3 wheels are self-contained (pip install secretspec). From a source checkout the extension is built on demand by the test harness via maturin develop, which needs maturin and a Rust toolchain on PATH.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

secretspec-0.18.0-cp39-abi3-win_amd64.whl (11.8 MB view details)

Uploaded Aug 4, 2026 CPython 3.9+Windows x86-64

secretspec-0.18.0-cp39-abi3-manylinux_2_28_x86_64.whl (16.1 MB view details)

Uploaded Aug 4, 2026 CPython 3.9+manylinux: glibc 2.28+ x86-64

secretspec-0.18.0-cp39-abi3-manylinux_2_28_aarch64.whl (16.0 MB view details)

Uploaded Aug 4, 2026 CPython 3.9+manylinux: glibc 2.28+ ARM64

secretspec-0.18.0-cp39-abi3-macosx_11_0_arm64.whl (13.3 MB view details)

Uploaded Aug 4, 2026 CPython 3.9+macOS 11.0+ ARM64

File details

Details for the file secretspec-0.18.0-cp39-abi3-win_amd64.whl.

File metadata

Download URL: secretspec-0.18.0-cp39-abi3-win_amd64.whl
Upload date: Aug 4, 2026
Size: 11.8 MB
Tags: CPython 3.9+, Windows x86-64
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for secretspec-0.18.0-cp39-abi3-win_amd64.whl
Algorithm	Hash digest
SHA256	`9dd6fd68a96f603758b14303c5dec8bf9276409bfb5be623902d03670f60b4e0`
MD5	`c338f431ded99cc5fe8686f8cf893bc9`
BLAKE2b-256	`c231835816cb9a0df6ad3986eacb7b78aed8b119eeb5352a91a987f7efffc9e9`

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.18.0-cp39-abi3-win_amd64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: secretspec-0.18.0-cp39-abi3-win_amd64.whl
- Subject digest: 9dd6fd68a96f603758b14303c5dec8bf9276409bfb5be623902d03670f60b4e0
- Sigstore transparency entry: 2339129864
- Sigstore integration time: Aug 4, 2026
Source repository:
- Permalink: cachix/secretspec@7ff76e8e351a6449e0a89289104a7ec62990461a
- Branch / Tag: refs/tags/v0.18.0
- Owner: https://github.com/cachix
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: python-wheels.yml@7ff76e8e351a6449e0a89289104a7ec62990461a
- Trigger Event: push

File details

Details for the file secretspec-0.18.0-cp39-abi3-manylinux_2_28_x86_64.whl.

File metadata

Download URL: secretspec-0.18.0-cp39-abi3-manylinux_2_28_x86_64.whl
Upload date: Aug 4, 2026
Size: 16.1 MB
Tags: CPython 3.9+, manylinux: glibc 2.28+ x86-64
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for secretspec-0.18.0-cp39-abi3-manylinux_2_28_x86_64.whl
Algorithm	Hash digest
SHA256	`4b41192dfbd05c26ddd643eb819c7e5f718478d92696e75c7876910f5a335e58`
MD5	`c4f186e0d1b9fef1a918941a6b6f2126`
BLAKE2b-256	`bf579d3527db645348abc09e3d019001a5f208ff65ca29754f414954382effa6`

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.18.0-cp39-abi3-manylinux_2_28_x86_64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: secretspec-0.18.0-cp39-abi3-manylinux_2_28_x86_64.whl
- Subject digest: 4b41192dfbd05c26ddd643eb819c7e5f718478d92696e75c7876910f5a335e58
- Sigstore transparency entry: 2339129857
- Sigstore integration time: Aug 4, 2026
Source repository:
- Permalink: cachix/secretspec@7ff76e8e351a6449e0a89289104a7ec62990461a
- Branch / Tag: refs/tags/v0.18.0
- Owner: https://github.com/cachix
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: python-wheels.yml@7ff76e8e351a6449e0a89289104a7ec62990461a
- Trigger Event: push

File details

Details for the file secretspec-0.18.0-cp39-abi3-manylinux_2_28_aarch64.whl.

File metadata

Download URL: secretspec-0.18.0-cp39-abi3-manylinux_2_28_aarch64.whl
Upload date: Aug 4, 2026
Size: 16.0 MB
Tags: CPython 3.9+, manylinux: glibc 2.28+ ARM64
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for secretspec-0.18.0-cp39-abi3-manylinux_2_28_aarch64.whl
Algorithm	Hash digest
SHA256	`0b2dd2a1882cd525a03e0b05217a48a56f5325e4ce2090a50b614799cb79545c`
MD5	`8eb98ad1240ce73912003626cb269882`
BLAKE2b-256	`a0bde14e8b9aa199cadb29d9bd30d5126ba18b5bde50f178054e50a09adb9604`

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.18.0-cp39-abi3-manylinux_2_28_aarch64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: secretspec-0.18.0-cp39-abi3-manylinux_2_28_aarch64.whl
- Subject digest: 0b2dd2a1882cd525a03e0b05217a48a56f5325e4ce2090a50b614799cb79545c
- Sigstore transparency entry: 2339129878
- Sigstore integration time: Aug 4, 2026
Source repository:
- Permalink: cachix/secretspec@7ff76e8e351a6449e0a89289104a7ec62990461a
- Branch / Tag: refs/tags/v0.18.0
- Owner: https://github.com/cachix
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: python-wheels.yml@7ff76e8e351a6449e0a89289104a7ec62990461a
- Trigger Event: push

File details

Details for the file secretspec-0.18.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

Download URL: secretspec-0.18.0-cp39-abi3-macosx_11_0_arm64.whl
Upload date: Aug 4, 2026
Size: 13.3 MB
Tags: CPython 3.9+, macOS 11.0+ ARM64
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for secretspec-0.18.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm	Hash digest
SHA256	`b6a539e494a9343d7eedb13f7270d997bf86e06728b8077aec8edb4869cad9e0`
MD5	`131484b25eb20c4c0ee02a9352921767`
BLAKE2b-256	`1b6e48fd4008e006b4b5dffc191a1b9ca2ce8ab565c87c12a6f7275a7c07ad28`

See more details on using hashes here.

Provenance

The following attestation bundles were made for secretspec-0.18.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: python-wheels.yml on cachix/secretspec

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: secretspec-0.18.0-cp39-abi3-macosx_11_0_arm64.whl
- Subject digest: b6a539e494a9343d7eedb13f7270d997bf86e06728b8077aec8edb4869cad9e0
- Sigstore transparency entry: 2339129872
- Sigstore integration time: Aug 4, 2026
Source repository:
- Permalink: cachix/secretspec@7ff76e8e351a6449e0a89289104a7ec62990461a
- Branch / Tag: refs/tags/v0.18.0
- Owner: https://github.com/cachix
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: python-wheels.yml@7ff76e8e351a6449e0a89289104a7ec62990461a
- Trigger Event: push

Release history Release notifications | RSS feed

0.19.1

Aug 12, 2026

0.19.0

Aug 11, 2026

This release

0.18.0

Aug 4, 2026

0.17.1

Aug 1, 2026

0.17.0

Jul 27, 2026

0.16.0

Jul 18, 2026

0.15.0

Jul 16, 2026

0.14.0

Jul 9, 2026

0.13.0

Jul 3, 2026

secretspec 0.18.0

secretspec (Python SDK)

Scopes (0.17+)

Cleanup

Value-free report

Native library

Project links

Key dates

1 maintainer

GitHub Statistics

License

Requires

Download files

Source Distributions

Built Distributions

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

Release history Release notifications | RSS feed