hexr.vault

import hexr.vault

# Get a secret — authenticated by your SPIFFE identity
api_key = hexr.vault.get("openai/api-key")

# Store a secret
hexr.vault.put("my-service/token", "sk-abc123")

# Delete a secret
hexr.vault.delete("my-service/token")

from hexr.vault import VaultClient

# Explicit client with custom settings
vault = VaultClient(
    base_url="http://hexr-vault.hexr-system:8091",
    tenant="acme-corp",
    timeout=30.0
)

from hexr.vault import secret

@secret("openai/api-key")
def get_openai_key():
    pass  # The return value is the secret

key = get_openai_key()  # Returns the secret value

@secret("optional/key", required=False, default="fallback")
def get_optional():
    pass

@secret("config/db", as_json=True)
def get_db_config():
    pass  # Returns parsed JSON

from hexr.vault import secrets_batch

@secrets_batch("openai/api-key", "anthropic/api-key", "db/password")
def init_services(**secrets):
    openai_key = secrets["openai_api_key"]      # path / → _
    anthropic_key = secrets["anthropic_api_key"]
    db_pass = secrets["db_password"]

from hexr.vault import VaultClient

# Auto-cleanup of connections
with VaultClient() as vault:
    key = vault.get("openai/api-key")
    vault.put("results/latest", "processed")

from hexr.vault import VaultError, SecretNotFoundError, PolicyDeniedError

try:
    secret = hexr.vault.get("restricted/secret")
except SecretNotFoundError:
    print("Secret doesn't exist")
except PolicyDeniedError:
    print("OPA policy denied access for your SPIFFE ID")
except VaultError as e:
    print(f"Vault error: {e}")