Compute
Inject secrets into sandboxes, functions, and scaling groups without exposing them in source or images.
Secrets let you inject credentials (API keys, database URLs, tokens) into a
workload without putting them in source code or baking them into an image.
Pass a list of Secret references to the secrets parameter of Sandbox,
ScalingGroup, or @chalkcompute.function; each one is resolved at deploy
time and exposed to the workload as an environment variable.
import chalkcompute
from chalkcompute import Secret
@chalkcompute.function(
secrets=[
Secret.from_chalk_env("OPENAI_API_KEY"),
Secret.from_chalk_integration("prod_postgres"),
],
)
def call_api(prompt: str) -> str:
import os
openai_api_key = os.environ["OPENAI_API_KEY"]
database_url = os.environ["DATABASE_URL"]
...The same secrets=[...] parameter and the same Secret constructors work
identically across all three primitives.
| Constructor | Description |
|---|---|
Secret.from_chalk_env(name, *, alias=None, prefix=None) | Reference a standalone secret by name from Chalk’s managed secret store, e.g. Secret.from_chalk_env("OPENAI_API_TOKEN"). |
Secret.from_chalk_integration(name, *, keys=None, aliases=None, prefix=None) | Inject every secret associated with a named Chalk integration (e.g. "prod_postgres") as env vars. |
Secret.from_local_env(local_env_var, *, env_var_name=None) | Read a local environment variable at deploy time and upsert it as a Chalk secret, handy for dev loops. |
Secret.from_local_env_file(path) | Upsert every KEY=VALUE line of a local .env file as a Chalk secret. |
Secret.from_env and Secret.from_integration still work as deprecated
aliases for from_chalk_env/from_chalk_integration, but new code should
use the from_chalk_* names.
By default, a secret is injected under an environment variable matching its
Chalk secret name. Use alias to rename it, or prefix to namespace every
key an integration exposes:
Secret.from_chalk_env("OPENAI_API_TOKEN", alias="API_KEY")
# injects OPENAI_API_TOKEN's value as API_KEY
Secret.from_chalk_integration("prod_postgres", prefix="PG_")
# injects prod_postgres's keys as PG_HOST, PG_USER, PG_PASSWORD, etc.
Secret.from_chalk_integration("prod_postgres", keys=["host", "password"])
# injects only the listed keys, instead of every key the integration exposesSecret.from_local_env and Secret.from_local_env_file resolve a value from
your own machine at deploy time, upsert it as a Chalk secret, and inject it
like any other secret, which is useful for iterating locally without first
creating the secret through chalk secret set or the dashboard:
from chalkcompute import Secret
Secret.from_local_env("OPENAI_API_KEY")
Secret.from_local_env("OPENAI_API_KEY", env_var_name="API_KEY") # inject under a different name
Secret.from_local_env_file(".env")These are lazy references — resolved once, when the workload actually deploys — not evaluated at import time.