Best practices for secrets

Use the secrets dashboard in your Baseten workspace to store sensitive data like access tokens, API keys, and passwords.

Every secret is a key-value pair with a “name” and “token.” Tokens can be multiple lines, which is useful for secrets like SSH and PGP keys. Note that for the secret “name”, all non-alphanumeric characters will be treated the same (i.e. "hf_access_token" and "hf-access-token" will map to the same underlying secret). This means that, if an existing secret with name `“hf_access_token” exists, attempting to create a secret with name “hf-access-token” will overwrite the existing key.

Adding, updating, and deleting secrets immediately affects all models that use said secrets.

​

Deploying models with secrets

When you deploy a model, use the --trusted flag to give it access to secrets in your Baseten workspace:

truss push --trusted

​

Using secrets in Truss

In your Truss, add the secret name in config.yaml but set the value to null:

...
secrets:
  hf_access_token: null
...

Then, access the secret from the secrets keyword argument in your model.py initialization:

def __init__(self, **kwargs):
    self._secrets = kwargs["secrets"]

You can then use the self._secrets dictionary in the load and predict functions:

def load(self):
    self._model = pipeline(
        "fill-mask",
        model="baseten/docs-example-gated-model",
        use_auth_token=self._secrets["hf_access_token"]
    )