from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, UniversalAuthMethod

# Initialize client
client = KMSClient(ClientSettings(
    site_url="https://kms.hanzo.ai",
    auth=AuthenticationOptions(
        universal_auth=UniversalAuthMethod(
            client_id="your-client-id",
            client_secret="your-client-secret",
        )
    )
))

# List all secrets
secrets = client.list_secrets(
    project_id="my-project",
    environment="production"
)

for secret in secrets:
    print(f"{secret.secret_key}: {secret.secret_value}")

# Get a specific secret
db_url = client.get_value(
    project_id="my-project",
    environment="production",
    secret_name="DATABASE_URL"
)

# Inject all secrets into environment
client.inject_env(
    project_id="my-project",
    environment="production"
)

Environment Variables

The client can be configured via environment variables:

export HANZO_KMS_URL="https://kms.hanzo.ai"
export HANZO_KMS_CLIENT_ID="your-client-id"
export HANZO_KMS_CLIENT_SECRET="your-client-secret"

Then simply:

from hanzo_kms import KMSClient

client = KMSClient()  # Uses environment variables
secrets = client.list_secrets("my-project", "production")

Authentication Methods

Universal Auth (Recommended)

from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, UniversalAuthMethod

client = KMSClient(ClientSettings(
    auth=AuthenticationOptions(
        universal_auth=UniversalAuthMethod(
            client_id="...",
            client_secret="...",
        )
    )
))

Kubernetes Auth

For workloads running in Kubernetes:

from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, KubernetesAuthMethod

client = KMSClient(ClientSettings(
    auth=AuthenticationOptions(
        kubernetes=KubernetesAuthMethod(
            identity_id="your-identity-id",
            # Uses default service account token path
        )
    )
))

AWS IAM Auth

from hanzo_kms import KMSClient, ClientSettings, AuthenticationOptions, AWSIamAuthMethod

client = KMSClient(ClientSettings(
    auth=AuthenticationOptions(
        aws_iam=AWSIamAuthMethod(
            identity_id="your-identity-id",
        )
    )
))

API Reference

KMSClient

Method	Description
`list_secrets(project_id, environment, path="/")`	List all secrets
`get_secret(project_id, environment, secret_name)`	Get a single secret
`get_value(project_id, environment, secret_name, default=None)`	Get just the value
`create_secret(project_id, environment, secret_name, secret_value)`	Create a secret
`update_secret(project_id, environment, secret_name, secret_value)`	Update a secret
`delete_secret(project_id, environment, secret_name)`	Delete a secret
`inject_env(project_id, environment, overwrite=False)`	Inject into os.environ

Compatibility

This SDK is compatible with:

Hanzo KMS (https://kms.hanzo.ai)
Lux KMS (https://kms.lux.network)

License

MIT License - see LICENSE for details.