Pass credentials to a run
Store an API token as a secret so every run can read it from its environment without putting it on the command line.
This guide shows how to give runs a credential, such as a Hugging Face or Weights & Biases token.
1. Store the secret
Pipe the value in on stdin, or read it from a variable of the same name in your shell:
printf %s "$HF_TOKEN" | div secrets set HF_TOKEN
div secrets set WANDB_API_KEY --from-envdiv secrets set does not accept the value as an argument, because shell history would keep it.
A new secret goes in the default environment and is available to runs and sandboxes. To keep it from sandboxes, pass --products runs:
div secrets set WANDB_API_KEY --from-env --products runs2. Read it in the run
Every run in the org gets, as environment variables, every secret in the default environment whose products include runs:
import os
token = os.environ["HF_TOKEN"]The run’s log lists the secrets it received. If the run prints a secret’s value, the log shows •••• in its place.
Do not use --env for credentials
--env values are saved with the run and shown in the dashboard. Use --env for settings, and secrets for credentials. If both set the same name, --env wins.
Rotate or remove a secret
Setting an existing name replaces the value and keeps its products. div secrets rm HF_TOKEN deletes it. Runs that have already started keep the value they received.
Secrets in other environments
Runs read only the default environment. Secrets you set with --environment reach only sandboxes created in that environment. See Keep each customer’s credentials in its own environment.