# Secrets
source: https://docs.chalk.ai/docs/compute/secrets

## Inject secrets into sandboxes, functions, and scaling groups without exposing them in source or images.

### Overview

Secrets let you inject credentials (API keys, database URLs, tokens) into a
workload without putting them in source code or baking them into an image.
Pass a list of Secret references to the secrets parameter of Sandbox,
ScalingGroup, or @chalkcompute.function; each one is resolved at deploy
time and exposed to the workload as an environment variable.

```
import chalkcompute
from chalkcompute import Secret

@chalkcompute.function(
    secrets=[
        Secret.from_chalk_env("OPENAI_API_KEY"),
        Secret.from_chalk_integration("prod_postgres"),
    ],
)
def call_api(prompt: str) -> str:
    import os
    openai_api_key = os.environ["OPENAI_API_KEY"]
    database_url = os.environ["DATABASE_URL"]
    ...
```

The same secrets=[...] parameter and the same Secret constructors work
identically across all three primitives.

### The Secret constructors

| Constructor                                                                    | Description                                                                                                                |
| ------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `Secret.from_chalk_env(name, *, alias=None, prefix=None)`                      | Reference a standalone secret by name from Chalk's managed secret store, e.g. `Secret.from_chalk_env("OPENAI_API_TOKEN")`. |
| `Secret.from_chalk_integration(name, *, keys=None, aliases=None, prefix=None)` | Inject every secret associated with a named Chalk integration (e.g. `"prod_postgres"`) as env vars.                        |
| `Secret.from_local_env(local_env_var, *, env_var_name=None)`                   | Read a local environment variable at deploy time and upsert it as a Chalk secret, handy for dev loops.                     |
| `Secret.from_local_env_file(path)`                                             | Upsert every `KEY=VALUE` line of a local `.env` file as a Chalk secret.                                                    |

Secret.from_env and Secret.from_integration still work as deprecated
aliases for from_chalk_env/from_chalk_integration, but new code should
use the from_chalk_* names.

### Aliasing and prefixing

By default, a secret is injected under an environment variable matching its
Chalk secret name. Use alias to rename it, or prefix to namespace every
key an integration exposes:

```
Secret.from_chalk_env("OPENAI_API_TOKEN", alias="API_KEY")
# injects OPENAI_API_TOKEN's value as API_KEY

Secret.from_chalk_integration("prod_postgres", prefix="PG_")
# injects prod_postgres's keys as PG_HOST, PG_USER, PG_PASSWORD, etc.

Secret.from_chalk_integration("prod_postgres", keys=["host", "password"])
# injects only the listed keys, instead of every key the integration exposes
```

### Local development

Secret.from_local_env and Secret.from_local_env_file resolve a value from
your own machine at deploy time, upsert it as a Chalk secret, and inject it
like any other secret, which is useful for iterating locally without first
creating the secret through chalk secret set or the dashboard:

```
from chalkcompute import Secret

Secret.from_local_env("OPENAI_API_KEY")
Secret.from_local_env("OPENAI_API_KEY", env_var_name="API_KEY")  # inject under a different name
Secret.from_local_env_file(".env")
```

These are lazy references — resolved once, when the workload actually
deploys — not evaluated at import time.