Skip to main content

​
secrets

AI Agent First-class secret references for credential fields (Issue #3102). Provides a lightweight, protocol-first contract so that any credential field (bot token, Slack app token, WhatsApp verify token, API keys) can be sourced from an environment variable, a mounted secret file, or a command / secret manager — instead of being committed as plaintext or exposed as a process-wide environment variable. Design goals (kept deliberately lightweight — stdlib only, no heavy imports):
  • SecretRef — a typed, immutable reference describing where a secret lives.
  • SecretInput — str | SecretRef | dict so plaintext and ${ENV} stay fully backward compatible; the reference form is purely additive.
  • SecretResolver — a pluggable protocol; the built-in resolver handles the env / file / exec sources with the stdlib alone.
  • register_secret_for_redaction / redact_secrets — a process-wide registry so resolved secret values can be scrubbed from logs and errors.
The wrapper (praisonai) and channel adapters may register additional resolvers (e.g. a Vault / AWS / GCP secret-manager resolver) without importing anything heavy into core.

​
Import

​
Classes

SecretRef

An immutable reference to a secret held outside the config file.

SecretResolution

Outcome of resolving a :class:SecretRef.

SecretResolver

Pluggable resolver contract. Implementations must not raise on a merely

DefaultSecretResolver

Stdlib-only resolver for the env / file / exec sources.

​
Functions

register_resolver()

Register a custom resolver for a source name (e.g. vault).

resolve_secret()

Resolve a credential input to a :class:SecretResolution.

is_secret_ref()

True if value is a :class:SecretRef or its dict reference form.

register_secret_for_redaction()

Register a resolved secret value so :func:redact_secrets masks it.

redact_secrets()

Replace every registered secret value in text with [REDACTED].

​
Constants