Skip to main content
See Secrets for how placeholder substitution works and usage examples.

​
Secret

Static factory for creating secret entries used in SandboxConfig.secrets.

​
Secret.env()

static env(envVar: string, opts: SecretEnvOptions): SecretEntry
Create a secret entry that maps an environment variable to a real value. The guest sees a placeholder - the real value is only substituted by the TLS proxy when traffic goes to an allowed host. Parameters
NameTypeDescription
envVarstringEnvironment variable name (e.g. "OPENAI_API_KEY")
optsSecretEnvOptionsSecret configuration
Returns
TypeDescription
SecretEntrySecret entry for SandboxConfig.secrets

​
Types

​
SecretEnvOptions

Configuration for a secret created via Secret.env().
FieldTypeDefaultDescription
valuestring-The real secret value. Never enters the guest VM. Required.
allowHosts?Array<string>[]Hosts allowed to receive the real value (exact match). The TLS proxy matches against the SNI.
allowHostPatterns?Array<string>[]Wildcard host patterns (e.g. "*.googleapis.com")
placeholder?string$MSB_<envVar>Custom placeholder string. Override when you need a specific format.
requireTls?booleantrueOnly substitute on TLS-intercepted connections. Disable only if you know the traffic is safe.
onViolation?ViolationAction'block'Action when the placeholder is sent to a disallowed host

​
SecretEntry

The object returned by Secret.env() and used in SandboxConfig.secrets.
FieldTypeDescription
envVarstringEnvironment variable name
valuestringSecret value
allowHosts?Array<string>Allowed hosts (exact match)
allowHostPatterns?Array<string>Wildcard patterns
placeholder?stringPlaceholder string
requireTls?booleanTLS identity requirement
onViolation?stringViolation action

​
ViolationAction

Action taken when a secret placeholder is sent to a disallowed host.
ValueDescription
'block'Silently drop the request. The guest sees a connection reset. This is the default.
'block-and-log'Drop the request and emit a warning log on the host side.
'block-and-terminate'Drop the request, log an error, and shut down the entire sandbox.