Skip to content

Commit cbb9fe8

Browse files
authored
Document Keyring integration
Added documentation for Keyring integration to securely load sensitive values.
1 parent 4531f6d commit cbb9fe8

File tree

1 file changed

+56
-0
lines changed

1 file changed

+56
-0
lines changed

docs/index.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2457,6 +2457,62 @@ For nested models, Secret Manager supports the `env_nested_delimiter` setting as
24572457

24582458
For more details on creating and managing secrets in Google Cloud Secret Manager, see the [official Google Cloud documentation](https://cloud.google.com/secret-manager/docs).
24592459

2460+
## Keyring
2461+
2462+
This integration allows you to securely load sensitive values such as passwords, API tokens, and other secrets directly from the system keyring. Instead of storing secrets in .env files or configuration files, you can fetch them at runtime using the operating system's secure credential store.
2463+
2464+
The Keyring integration requires additional dependencies:
2465+
2466+
```bash
2467+
pip install "pydantic-settings[keyring]"
2468+
```
2469+
2470+
There is one mandatory parameter:
2471+
- `keyring_service`: keyring service name
2472+
2473+
Add `KeyringConfigSettingsSource` to your settings sources:
2474+
2475+
```python
2476+
from pydantic import SecretStr
2477+
from pydantic_settings import (
2478+
BaseSettings,
2479+
KeyringConfigSettingsSource,
2480+
PydanticBaseSettingsSource,
2481+
SettingsConfigDict,
2482+
)
2483+
2484+
class Settings(BaseSettings):
2485+
secret_key: SecretStr
2486+
2487+
@classmethod
2488+
def settings_customise_sources(
2489+
cls,
2490+
settings_cls: type[BaseSettings],
2491+
init_settings: PydanticBaseSettingsSource,
2492+
env_settings: PydanticBaseSettingsSource,
2493+
dotenv_settings: PydanticBaseSettingsSource,
2494+
file_secret_settings: PydanticBaseSettingsSource,
2495+
) -> tuple[PydanticBaseSettingsSource, ...]:
2496+
keyring_settings = KeyringConfigSettingsSource(
2497+
settings_cls,
2498+
keyring_service=os.environ["KEYRING_SERVICE"],
2499+
)
2500+
2501+
return (
2502+
init_settings,
2503+
env_settings,
2504+
dotenv_settings,
2505+
file_secret_settings,
2506+
keyring_settings,
2507+
)
2508+
```
2509+
2510+
To set a secret, you can use `keyring set <keyring_service> <field_name>` in your terminal:
2511+
2512+
```bash
2513+
$ keyring set myapp secret_key
2514+
```
2515+
24602516
## Other settings source
24612517

24622518
Other settings sources are available for common configuration files:

0 commit comments

Comments
 (0)