Secrets

SecretUtils is a Bakebook mixin from bakelib.utils that wires a RefreshableCacheRegistry into your bakebook and adds the bake secret commands. It reuses the same FetchFn you define for the refreshable cache. Override get_secret_fetch_fns to declare which keys are tracked:

from bakelib.utils import SecretUtils


class MyBakebook(SecretUtils[str]):
    def get_secret_fetch_fns(self):
        return (GcpSecretFetchFn(key="api_key", project_id="my-project", secret_id="api-key"),)

Only tracked keys can be set or read. The bake secret group:

bake secret list - tracked keys with cached/not-cached status (shows the namespace)
bake secret get KEY - print a cached value
bake secret set KEY VALUE - store a value (plain, not prompted)
bake secret del [KEY] - delete one key, or all if none given
bake secret refresh [KEY] - re-run the fetch functions for one key, or all

The default backend chain is MemoryCache + KeyringCache under the namespace "bakebook". Override get_secret_namespace() to isolate secrets per project. For more details, see the bakelib source.

Last modified on September 6, 2026

Welcome

Getting Started

Concepts

Usage

CLI Reference

bakelib

Examples

Troubleshooting