mirror of
https://github.com/hanzoai/python-sdk.git
synced 2026-10-23 20:23:00 +00:00
zeekayandHanzo Dev
22867fa43f
hanzo-kms (sync + async): /api/v1/auth/universal-auth/login →
/v1/kms/auth/login. Body already canonical {clientId,clientSecret};
TokenResponse already parses {accessToken,expiresIn,tokenType}.
Scoped per CTO ruling: ONLY endpoints with a real canonical /v1/kms/*
target are migrated. The remaining /api/v3/secrets/raw/*,
/api/v1/auth/{kubernetes-auth,aws-auth}/login and /api/v3/auth/login
have NO canonical route (or a different API shape) on the kms.hanzo.ai
server and are left intact — rewriting them would mint dead /v1 paths.
They are flagged for a separate SDK-port task. Clean break, no aliases
(org rule: one way, /v1/, never /api/).
Co-authored-by: Hanzo Dev <[email protected]>
Hanzo KMS - Python SDK
Official Python SDK for Hanzo KMS - Secret management for your applications.
Installation
pip install hanzo-kms
Or with uv:
uv add hanzo-kms
Quick Start
from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, UniversalAuthMethod
# Initialize client
client = KMSClient(ClientSettings(
site_url="https://kms.hanzo.ai",
auth=AuthenticationOptions(
universal_auth=UniversalAuthMethod(
client_id="your-client-id",
client_secret="your-client-secret",
)
)
))
# List all secrets
secrets = client.list_secrets(
project_id="my-project",
environment="production"
)
for secret in secrets:
print(f"{secret.secret_key}: {secret.secret_value}")
# Get a specific secret
db_url = client.get_value(
project_id="my-project",
environment="production",
secret_name="DATABASE_URL"
)
# Inject all secrets into environment
client.inject_env(
project_id="my-project",
environment="production"
)
Environment Variables
The client can be configured via environment variables:
export HANZO_KMS_URL="https://kms.hanzo.ai"
export HANZO_KMS_CLIENT_ID="your-client-id"
export HANZO_KMS_CLIENT_SECRET="your-client-secret"
Then simply:
from hanzo_kms import KMSClient
client = KMSClient() # Uses environment variables
secrets = client.list_secrets("my-project", "production")
Authentication Methods
Universal Auth (Recommended)
from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, UniversalAuthMethod
client = KMSClient(ClientSettings(
auth=AuthenticationOptions(
universal_auth=UniversalAuthMethod(
client_id="...",
client_secret="...",
)
)
))
Kubernetes Auth
For workloads running in Kubernetes:
from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, KubernetesAuthMethod
client = KMSClient(ClientSettings(
auth=AuthenticationOptions(
kubernetes=KubernetesAuthMethod(
identity_id="your-identity-id",
# Uses default service account token path
)
)
))
AWS IAM Auth
from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, AWSIamAuthMethod
client = KMSClient(ClientSettings(
auth=AuthenticationOptions(
aws_iam=AWSIamAuthMethod(
identity_id="your-identity-id",
)
)
))
API Reference
KMSClient
| Method | Description |
|---|---|
list_secrets(project_id, environment, path="/") |
List all secrets |
get_secret(project_id, environment, secret_name) |
Get a single secret |
get_value(project_id, environment, secret_name, default=None) |
Get just the value |
create_secret(project_id, environment, secret_name, secret_value) |
Create a secret |
update_secret(project_id, environment, secret_name, secret_value) |
Update a secret |
delete_secret(project_id, environment, secret_name) |
Delete a secret |
inject_env(project_id, environment, overwrite=False) |
Inject into os.environ |
Compatibility
This SDK is compatible with:
- Hanzo KMS (https://kms.hanzo.ai)
- Lux KMS (https://kms.lux.network)
License
MIT License - see LICENSE for details.