Credentials

Pass secrets and API keys to your remote GPU functions securely.

Your GPU functions run on remote infrastructure. Credentials tells urun which secrets to make available to the remote function, and from where. Import it from urun.core:

from urun.core import Credentials

Where secrets come from

A secret is either forwarded from where you deploy, or pulled from uRun's Vault. Pick the source per secret:

Parameter	Source	Required to exist?	Use for
`env=[...]`	Forwarded from your local / CI environment at deploy	Yes — deploy fails if unset	Secrets you already hold locally or in CI (`HF_TOKEN`, `OPENAI_API_KEY`)
`optional_env=[...]`	Same as `env=`, but best-effort	No — silently skipped if unset	Optional accelerators (e.g. a `HF_TOKEN` that just raises rate limits)
`platform=[...]`	Pulled from uRun's Vault (console → Settings → Secrets)	Must exist in Vault, not locally	Server-managed secrets shared across functions; secrets you don't want on your laptop or in CI

In every case the secret lands as a plain environment variable inside the function. The difference is purely where uRun reads it from — your machine (env/optional_env) or platform Vault (platform). Do not use env= to read a Vault secret; use platform=.

Forward a HuggingFace token

For downloading gated models (LLaMA, Gemma) or private repos:

creds = Credentials(env=["HF_TOKEN"])

@app.function(gpus="h100:1", credentials=creds)
def serve(ctx):
    # HF_TOKEN is available as an environment variable
    from huggingface_hub import login
    login(token=os.environ["HF_TOKEN"])
    ...

Set HF_TOKEN in your local environment before running. urun forwards it securely to the remote function.

Call an external realtime API

A live session often talks to an external provider — for example a voice app that pipes its audio through OpenAI's Realtime API:

creds = Credentials(env=["OPENAI_API_KEY"])

@app.function(gpus="l4:1", credentials=creds)
def voice(ctx):
    from openai import AsyncOpenAI
    client = AsyncOpenAI()  # picks up OPENAI_API_KEY automatically
    ...

Forward keys for multiple services

List all the environment variables your function needs:

creds = Credentials(env=["HF_TOKEN", "OPENAI_API_KEY"])

@app.function(gpus="h100:1", credentials=creds)
def serve(ctx):
    import os
    hf_token = os.environ["HF_TOKEN"]
    openai_key = os.environ["OPENAI_API_KEY"]
    ...

Use platform-managed secrets

For secrets stored in urun's platform (set once, available to all your functions) rather than forwarded from your local environment:

creds = Credentials(platform=["my-api-key"])

@app.function(gpus="h100:1", credentials=creds)
def serve(ctx):
    import os
    api_key = os.environ["my-api-key"]
    ...

Platform secrets are configured in the console under Settings → Secrets (Vault-backed) and don't need to exist in your local environment.

Accessing credentials in your function

All credentials are available as standard environment variables inside the function:

import os

@app.function(gpus="h100:1", credentials=Credentials(env=["HF_TOKEN", "OPENAI_API_KEY"]))
def serve(ctx):
    hf_token = os.environ["HF_TOKEN"]
    openai_key = os.environ["OPENAI_API_KEY"]
    ...

This means any library that reads from environment variables (HuggingFace Hub, OpenAI, etc.) works automatically — you don't need to pass credentials to library code manually.

Combining with dependencies

Credentials and Dependencies are separate concerns that attach to the same function:

from urun import App
from urun.core import Dependencies, Credentials

app = App("my-app")

deps = Dependencies(python=["torch", "transformers", "openai"])
creds = Credentials(env=["HF_TOKEN", "OPENAI_API_KEY"])

@app.function(gpus="h100:1", deps=deps, credentials=creds)
def serve(ctx):
    ...

Dependencies installs what your code needs to run. Credentials provides the secrets your code needs to authenticate.

Related:

Dependencies — Python packages and system libraries
App — The @app.function decorator