> ## Documentation Index
> Fetch the complete documentation index at: https://bakefile.wisl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> SecretUtils wires a RefreshableCacheRegistry into your bakebook and adds the bake secret commands for tracked keys.

`SecretUtils` is a `Bakebook` mixin from `bakelib.utils` that wires a `RefreshableCacheRegistry` into your bakebook and adds the `bake secret` commands. It reuses the same `FetchFn` you define for the [refreshable cache](/bakelib/cache). Override `get_secret_fetch_fns` to declare which keys are tracked:

```python theme={"theme":{"light":"github-light","dark":"github-dark"}}
from bakelib.utils import SecretUtils


class MyBakebook(SecretUtils[str]):
    def get_secret_fetch_fns(self):
        return (GcpSecretFetchFn(key="api_key", project_id="my-project", secret_id="api-key"),)
```

Only tracked keys can be set or read. The `bake secret` group:

* `bake secret list` - tracked keys with cached/not-cached status (shows the namespace)
* `bake secret get KEY` - print a cached value
* `bake secret set KEY VALUE` - store a value (plain, not prompted)
* `bake secret del [KEY]` - delete one key, or all if none given
* `bake secret refresh [KEY]` - re-run the fetch functions for one key, or all

The default backend chain is `MemoryCache` + `KeyringCache` under the namespace `"bakebook"`. Override `get_secret_namespace()` to isolate secrets per project.

For more details, see the [bakelib source](https://github.com/wislertt/bakefile/tree/main/src/bakelib).