Secrets & Credential Vault

The secret store

Secrets are write-only values scoped per account:

client.secrets.create("github-prod", "ghp_...")
client.secrets.list()      # names and metadata only
client.secrets.delete("github-prod")

Values are encrypted at rest and never returned by any API — not even to the key that wrote them. The console shows names only.

Binding secrets to sandboxes

Store once, attach by name at creation, with a host allowlist:

sandbox = client.sandboxes.create(
    template="python",
    secrets=[{
        "name": "github-prod",
        "auth_type": "bearer",
        "hosts": ["api.github.com"],
    }],
)

The intent: the sandbox runs with fake/empty credentials; when its requests match the binding (host, method, path), Ovrin injects the real value at the network boundary. The real secret never enters the sandbox filesystem, environment, or logs — give your agents access, not your secrets.

Bindings are default-deny: hosts you did not list resolve nowhere.

Availability

Credential-vault bindings are not available yet

Creating a sandbox with secrets= bindings is not supported on the current runtime and fails with credential_vault_unavailable.

Until it is enabled, the supported pattern is explicit injection through env, with the tenant egress policy as the boundary:

# Explicit but constrained: env injection + default-deny-ish baseline egress.
sandbox = client.sandboxes.create(
    template="claude-code",
    env={"ANTHROPIC_API_KEY": key},
)

Two production patterns already run this way end-to-end: the agent-payments key (a payments-scoped key injected into payments=True sandboxes) and agent template auth tokens.