Secrets - Gravix Layer

Keep API keys out of sandbox code. Create an Identity provider, add key/value secrets, attach it to a runtime (sandbox), and those secrets become environment variables on each run_code / run_cmd.

Manage Identity providers in Identity → Providers on the platform, or via client.identity.providers / /v1/identity/providers. Secret values are write-only — list/get return masked placeholders only.

Why Identity providers?

Without	With
Keys in prompts or scripts	Keys encrypted in Identity
Copy keys into every sandbox	Attach once; reuse across runtimes
Painful rotation	Update the Identity provider; next execution uses the new value

Secrets are resolved at execution time. They are not stored in the runtime’s persisted env record.

Behavior

Secret keys become env var names (OPENAI_API_KEY).
Same key on an Identity provider overwrites the previous value.
Attach at create (providers=[...]) or later with client.identity.providers.attach(...).
After detach, the next execution no longer receives those keys.
Interactive terminal/SSH does not auto-inherit Identity provider secrets — use run_code or run_cmd.

Create an Identity provider

from gravixlayer import GravixLayer

client = GravixLayer()

provider = client.identity.providers.create(
    name="OpenAI",
    provider_type="openai",
    secrets=[{"key": "OPENAI_API_KEY", "value": "sk-..."}],
)
print(provider.id)

curl -X POST "https://api.gravixlayer.ai/v1/identity/providers" \
  -H "Authorization: Bearer $GRAVIXLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "OpenAI",
    "provider_type": "openai",
    "secrets": [
      {"key": "OPENAI_API_KEY", "value": "sk-..."}
    ]
  }'

Multiple secrets

One Identity provider can hold several keys:

provider = client.identity.providers.create(
    name="External APIs",
    provider_type="custom",
    secrets=[
        {"key": "OPENAI_API_KEY", "value": "sk-..."},
        {"key": "ANTHROPIC_API_KEY", "value": "sk-ant-..."},
        {"key": "GITHUB_TOKEN", "value": "ghp_..."},
    ],
)

curl -X POST "https://api.gravixlayer.ai/v1/identity/providers" \
  -H "Authorization: Bearer $GRAVIXLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "External APIs",
    "provider_type": "custom",
    "secrets": [
      {"key": "OPENAI_API_KEY", "value": "sk-..."},
      {"key": "ANTHROPIC_API_KEY", "value": "sk-ant-..."},
      {"key": "GITHUB_TOKEN", "value": "ghp_..."}
    ]
  }'

Attach at create

runtime = client.runtime.create(
    template="python-3.14-base-small",
    providers=[provider.id],
)

result = runtime.run_code(
    code="import os; print('ok' if os.environ.get('OPENAI_API_KEY') else 'missing')"
)
print(result.text)

curl -X POST "https://api.gravixlayer.ai/v1/agents/runtime" \
  -H "Authorization: Bearer $GRAVIXLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "python-3.14-base-small",
    "provider": "azure",
    "region": "eastus2",
    "providers": ["PROVIDER_ID"]
  }'

Attach to a running sandbox

client.identity.providers.attach(provider.id, runtime.runtime_id)

result = runtime.run_code(
    code="import os; print(os.environ['OPENAI_API_KEY'][:7])"
)

curl -X POST "https://api.gravixlayer.ai/v1/identity/providers/PROVIDER_ID/attach" \
  -H "Authorization: Bearer $GRAVIXLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"runtime_id": "RUNTIME_ID"}'

Use secrets in code

result = runtime.run_code(code="""
import os
import urllib.request

req = urllib.request.Request(
    "https://api.openai.com/v1/models",
    headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"},
)
print(urllib.request.urlopen(req).status)
""")
print(result.text)

Detach

client.identity.providers.detach(provider.id, runtime.runtime_id)

result = runtime.run_code(
    code="import os; print(os.environ.get('OPENAI_API_KEY', 'missing'))"
)

runtime.kill()
client.identity.providers.delete(provider.id)

curl -X DELETE \
  "https://api.gravixlayer.ai/v1/identity/providers/PROVIDER_ID/attach/RUNTIME_ID" \
  -H "Authorization: Bearer $GRAVIXLAYER_API_KEY"

SDK reference

All Identity provider operations live under client.identity.providers (maps to /v1/identity/providers).

Method	Purpose
`create(...)`	Create an Identity provider (optional initial secrets)
`list(...)`	List Identity providers (masked)
`get(provider_id)`	Get one Identity provider (masked secrets)
`update(provider_id, ...)`	Update name, type, or `is_active`
`delete(provider_id)`	Soft-delete the Identity provider
`add_secret(provider_id, key, value)`	Add or upsert a secret pair
`list_secrets(provider_id)`	List secret keys (values masked)
`update_secret(provider_id, secret_id, ...)`	Rename key and/or replace value
`delete_secret(provider_id, secret_id)`	Delete a secret pair
`attach(provider_id, runtime_id)`	Attach to a runtime sandbox
`detach(provider_id, runtime_id)`	Detach from a runtime sandbox
`list_for_runtime(runtime_id)`	List Identity providers attached to a runtime

# Provider CRUD
providers = client.identity.providers.list()
provider = client.identity.providers.get(provider.id)
client.identity.providers.update(provider.id, name="OpenAI Prod", is_active=True)
client.identity.providers.delete(provider.id)

# Secret pair CRUD
client.identity.providers.add_secret(provider.id, key="OPENAI_API_KEY", value="sk-...")
secrets = client.identity.providers.list_secrets(provider.id)
client.identity.providers.update_secret(provider.id, secret_id, value="sk-new-...")
client.identity.providers.delete_secret(provider.id, secret_id)

# Attach / detach
client.identity.providers.attach(provider.id, runtime.runtime_id)
client.identity.providers.list_for_runtime(runtime.runtime_id)
client.identity.providers.detach(provider.id, runtime.runtime_id)

CLI

gravixlayer provider create --name OpenAI --type openai \
  --secret OPENAI_API_KEY=sk-...

gravixlayer runtime create --template python-3.14-base-small \
  --provider PROVIDER_ID

gravixlayer provider list-attached RUNTIME_ID
gravixlayer provider detach PROVIDER_ID RUNTIME_ID

Create Runtime

Create a sandbox with Identity providers

Run Python

Execute code that reads env vars

​Why Identity providers?

​Behavior

​Create an Identity provider

​Multiple secrets

​Attach at create

​Attach to a running sandbox

​Use secrets in code

​Detach

​SDK reference

​CLI

​Next

Create Runtime

Run Python

Why Identity providers?

Behavior

Create an Identity provider

Multiple secrets

Attach at create

Attach to a running sandbox

Use secrets in code

Detach

SDK reference

CLI

Next