Description

# Azure Key Vault Secrets client library for Python Azure Key Vault helps solve the following problems: - Secrets management (this library) - securely store and control access to tokens, passwords, certificates, API keys, and other secrets - Cryptographic key management ([azure-keyvault-keys](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys)) - create, store, and control access to the keys used to encrypt your data - Certificate management ([azure-keyvault-certificates](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates)) - create, manage, and deploy public and private SSL/TLS certificates - Vault administration ([azure-keyvault-administration](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration)) - role-based access control (RBAC), and vault-level backup and restore options [Source code][library_src] | [Package (PyPI)][pypi_package_secrets] | [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/) | [API reference documentation][reference_docs] | [Product documentation][azure_keyvault] | [Samples][secret_samples] ## _Disclaimer_ _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_. _Python 3.9 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/blob/main/doc/python_version_support_policy.md)._ ## Getting started ### Install packages Install [azure-keyvault-secrets][pypi_package_secrets] and [azure-identity][azure_identity_pypi] with [pip][pip]: ```Bash pip install azure-keyvault-secrets azure-identity ``` [azure-identity][azure_identity] is used for Azure Active Directory authentication as demonstrated below. ### Prerequisites * An [Azure subscription][azure_sub] * Python 3.9 or later * An existing [Azure Key Vault][azure_keyvault]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][azure_keyvault_cli]. ### Authenticate the client In order to interact with the Azure Key Vault service, you will need an instance of a [SecretClient][secret_client_docs], as well as a **vault url** and a credential object. This document demonstrates using a [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios, including local development and production environments. We recommend using a [managed identity][managed_identity] for authentication in production environments. See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their corresponding credential types. #### Create a client After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a secret client (replacing the value of `VAULT_URL` with your vault's URL): <!-- SNIPPET:hello_world.create_secret_client --> ```python VAULT_URL = os.environ["VAULT_URL"] credential = DefaultAzureCredential() client = SecretClient(vault_url=VAULT_URL, credential=credential) ``` <!-- END SNIPPET --> > **NOTE:** For an asynchronous client, import `azure.keyvault.secrets.aio`'s `SecretClient` instead. ## Key concepts ### Secret A secret consists of a secret value and its associated metadata and management information. This library handles secret values as strings, but Azure Key Vault doesn't store them as such. For more information about secrets and how Key Vault stores and manages them, see the [Key Vault documentation](https://learn.microsoft.com/azure/key-vault/general/about-keys-secrets-certificates). [SecretClient][secret_client_docs] can set secret values in the vault, update secret metadata, and delete secrets, as shown in the [examples](#examples) below. ## Examples This section contains code snippets covering common tasks: * [Set a secret](#set-a-secret) * [Retrieve a secret](#retrieve-a-secret) * [Update secret metadata](#update-secret-metadata) * [Delete a secret](#delete-a-secret) * [List secrets](#list-secrets) * [Async API](#async-api) * [Asynchronously create a secret](#asynchronously-create-a-secret) * [Asynchronously list secrets](#asynchronously-list-secrets) ### Set a secret [set_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.set_secret) creates new secrets and changes the values of existing secrets. If no secret with the given name exists, `set_secret` creates a new secret with that name and the given value. If the given name is in use, `set_secret` creates a new version of that secret, with the given value. ```python from azure.identity import DefaultAzureCredential from azure.keyvault.secrets import SecretClient credential = DefaultAzureCredential() secret_client = SecretClient