Secret
Secrets: named environment values for sandboxes, agents and apps.
openai = noclick.Secret.from_name("openai", values={"OPENAI_API_KEY": "sk-..."}, create_if_missing=True)
with noclick.Sandbox.create(secrets=[openai]) as sb:
sb.exec("python summarize.py") # reads os.environ["OPENAI_API_KEY"]A Connection is an account at a service NoClick calls for you, with tokens it
keeps fresh; a Secret is raw values for code you run. Values are write-only:
keys names them, and nothing reads one back.
class SecretNamed values, such as API keys, that the code you run reads from its environment: a sandbox's
commands, an agent's shell, an app. Each key becomes an environment variable of that name.
Values are write-only: keys names them, and nothing reads one back. (A Connection is an
account at a service NoClick calls for you; a Secret is raw values for code you run.)
- Like every live object, it also has hydrate(), refresh() and raw.
| id | string | |
| name | string | |
| keys | string[] | The names it holds; never their values. |
| userId | string | null | |
| createdAt | Date | null | |
| updatedAt | Date | null | When its values last changed. |
| usedBy | UsedBy[] | Who reads it: agents, running sandboxes, and apps (with the |
| consoleUrl | string | null | This secret in the developer console (null off the hosted API). |
createstatic
static create(name: string, options?: SecretCreateOptions): Promise<Secret>Create a secret, unique by name per user (a taken name throws Conflict with existingId).
undefined = the ambient user (asUser), null = the account itself.
The client to send with; defaults to the module client built from NOCLICK_API_KEY.
Up to 100 keys, each an environment variable name (not PATH, HOME or one starting LD_, NC_ or NOCLICK_), each value a string of up to 32,768 characters.
The new secret; its keys name what it holds.
fromNamestatic
static fromName(
name: string,
options?: SecretCreateOptions & { createIfMissing?: boolean },
): SecretA lazy reference to the secret called name: the user's own first, then the account's. With
createIfMissing your code is the definition: the current (or given) user's is created on first
use, holding values, and on one that exists the keys in values are set to match (NoClick
compares them, so unchanged values change nothing). Keys it doesn't name are kept.
Up to 100 keys, each an environment variable name (not PATH, HOME or one starting LD_, NC_ or NOCLICK_), each value a string of up to 32,768 characters.
undefined = the ambient user (asUser), null = the account itself.
The client to send with; defaults to the module client built from NOCLICK_API_KEY.
A secret that loads (or is created) the first time it's used. Nothing is sent yet.
fromIdstatic
static fromId(secretId: string, options?: CallOptions): SecretA lazy reference to a secret by id.
A secret that loads the first time you read a field. Nothing is sent yet.
getstatic
static get(secretId: string, options?: CallOptions): Promise<Secret>Load a secret by id now; an unknown id raises noclick.NotFound.
The secret, loaded: its key names, when they last changed, and who uses it. Never its values.
liststatic
static list(options?: ReadOptions & { limit?: number }): Promise<Secret[]>The current user's secrets and the account's (or those userFilter covers), names only.
Return at most this many.
Which users the read covers (user_id query), instead of acting as one (user).
undefined = the ambient user (asUser), null = the account itself.
The client to send with; defaults to the module client built from NOCLICK_API_KEY.
Every matching secret, newest first, fetched page by page, with key names and never values.
listPagestatic
static listPage(options?: ReadOptions & PageOptions): Promise<Page<Secret>>One page of secrets; pass nextCursor back as cursor.
The next_cursor of the page before; omit it for the first page.
Return at most this many.
Which users the read covers (user_id query), instead of acting as one (user).
undefined = the ambient user (asUser), null = the account itself.
The client to send with; defaults to the module client built from NOCLICK_API_KEY.
A page whose data holds the secrets and whose next_cursor is None on the last page.
update
update(
values: Record<string, string | null>,
options?: { replace?: boolean },
): Promise<this>Set values. They merge by default: the keys you pass are set, a key set to null is removed,
the rest are kept. replace makes it hold exactly values. New sandboxes see the change at
once, agents from their next turn, apps at their next deployment.
This secret, with its new keys and updated_at.
versions
versions(): Promise<Version[]>What it held before each change of the last 30 days, newest first: the keys, never the values.
Each earlier version.
restoreVersion
restoreVersion(version: Version | string): Promise<this>Hold version's keys and values again; they come back sealed, never shown or sent.
This secret, holding them.
delete
delete(): Promise<void>Delete the secret for good (its versions go with it); while an agent lists it or an app binds it, this throws Conflict.
Version
interface VersionA value a secret or setting held before replacedAt. op says what replaced it: changed (a new
value) or deleted. A secret's version never shows its value: keys names what a Secret held
and environment is where an app's secret was set; a setting's shows its value.
| id | string | |
| name | string | |
| op | "changed" | "deleted" | |
| replacedAt | Date | null | |
| environment | string | null | |
| keys | string[] | null | |
| value | string | null | |
| raw | JsonObject | The response JSON exactly as the API sent it. |