Secryn Python SDK

Python client for the Secryn secrets management API.
Manage projects, secrets, API keys, and team members programmatically.

Installation

pip install secryn

Requires Python 3.10+.

Quick Start

from secryn import SecrynClient

# Connect to your Secryn instance
client = SecrynClient(base_url="https://api.secryn.xyz/api/v1")

# Cookie-based auth
client.auth.login("user@example.com", "password")

# OR API-key-based auth
client = SecrynClient(
    base_url="https://api.secryn.xyz/api/v1",
    api_key="sc_...",
)

Usage

All API resources are accessible as namespaced sub-objects with full autocompletion support.

Auth

client.auth.login("user@example.com", "password")
client.auth.register("new@example.com", "secure123")
client.auth.logout()                # clears session cookies
client.auth.refresh()               # extends JWT session
client.auth.forgot_password("user@example.com")
client.auth.reset_password(token, "new-password")

MFA

setup = client.mfa.setup()          # returns secret + QR code URL
client.mfa.enable(token)
client.mfa.confirm(token, mfa_token)
client.mfa.recovery(code, mfa_token)
client.mfa.status()                 # -> {"enabled": True}
codes = client.mfa.recovery_codes() # -> {"codes": ["...", ...]}
client.mfa.send_backup_code("user@example.com")
client.mfa.disable()

Projects

projects = client.projects.list()
project = client.projects.create("My Project", description="Backend secrets")
info = client.projects.get(project_id)
client.projects.update(project_id, name="Renamed")
client.projects.transfer(project_id, new_owner_id)
client.projects.delete(project_id)

Members & Invites

# Invite someone to a project
client.invites.create(project_id, email="dev@team.com")

# Accept an invitation by slug
client.invites.accept("abc123")

# Manage members
client.members.add_permissions(project_id, member_id, ["READ_SECRETS"])
client.members.remove_permissions(project_id, member_id, ["READ_SECRETS"])
client.members.remove(project_id, member_id)

Secrets

# Create, read, update, delete
secret = client.secrets.create(project_id, "API_KEY", "sk-abc123", notes="Production key")
secret = client.secrets.get(secret_id)
secrets = client.secrets.list(project_id)
client.secrets.update(secret_id, value="sk-new-value")

# Export as .env
dotenv = client.secrets.export_dotenv(project_id)  # str
with open(".env", "w") as f:
    f.write(dotenv)

client.secrets.delete(secret_id)

API Keys

key = client.api_keys.create("CI/CD Pipeline", permissions=["read"])
keys = client.api_keys.list()
client.api_keys.update(key_id, name="CI Pipeline v2")
client.api_keys.delete(key_id)

Users

profile = client.users.me()         # authenticated user
user = client.users.get(user_id)
client.users.update(name="New Name", email="new@example.com")
client.users.delete()               # deletes authenticated account

Error Handling

from secryn import SecrynApiError

try:
    client.secrets.get("nonexistent")
except SecrynApiError as e:
    print(e.status_code)  # 404
    print(e.code)         # "NOT_FOUND"
    print(e.message)      # "Secret not found"
    print(e.details)      # Optional structured context

Configuration

License

Apache 2.0 — see LICENSE.