Secrets
Store secrets that your functions receive at runtime
Settings → Secrets is where you store the secret values your functions need at runtime — API tokens, model-hub credentials, and the like. Secrets are Vault-backed.
How it connects to your code
Your Python app declares which secrets it needs via Credentials on the @app.function
decorator, and uRun injects the matching values as environment variables when the function
runs. You set the values here; your code declares the names.
Secrets stored on this page are platform-managed (Vault-backed, server-side), so your
code declares them with Credentials(platform=[...]) — not env=[...], which forwards
values from your local shell at deploy time and never reads this page. Use platform=
for anything that should live on the server and never touch a developer's machine.
from urun import App, Context
from urun.core import Credentials
app = App("my-app")
@app.function(gpus="h100:1", credentials=Credentials(platform=["HF_TOKEN"]))
def run(ctx: Context):
import os
token = os.environ["HF_TOKEN"] # value comes from Settings → Secrets (Vault)
...| Declaration | Where the value comes from | Use for |
|---|---|---|
Credentials(platform=["NAME"]) | This page — Settings → Secrets (Vault) | Server-side secrets set once for the org |
Credentials(env=["NAME"]) | Your local / CI environment at deploy time | Forwarding a token you already hold locally |
Credentials(optional_env=["NAME"]) | Local env if present, else skipped | Optional local forwards |
See Credentials for the full declaration side.
When to use it
- Store a HuggingFace token so model downloads authenticate.
- Provide third-party API keys your runtime calls out to.
- Rotate a secret without redeploying code — update the value, the next session picks it up.
Secrets here are for runtime injection into your functions (Vault-backed, server-side). They are not the org deploy API key (that's API Keys) and never reach the browser.