Secrets - Kernel

There are multiple ways to pass secrets and API keys to your Kernel app:

1. Deployment environment variables

Deploy your app with secrets as environment variables. Your app can then access them at runtime. You can set environment variables in two ways:

--env flag: Pass individual key-value pairs directly in the command
--env-file flag: Load variables from a .env file

# Using --env flag for individual variables
kernel deploy my_app.ts --env OPENAI_API_KEY=sk-... --env ANTHROPIC_API_KEY=sk-ant-...

# Using --env-file to load from a file
kernel deploy my_app.ts --env-file .env

# Combine both approaches
kernel deploy my_app.ts --env-file .env --env OPENAI_API_KEY=sk-...

Then access the variables in your app:

import Anthropic from "@anthropic-ai/sdk";
import OpenAI from "openai";

app.action('ai-action', async (ctx: KernelContext) => {
  // Access API keys from environment variables
  const anthropic = new Anthropic({
    apiKey: process.env.ANTHROPIC_API_KEY,
  });

  const openai = new OpenAI({
    apiKey: process.env.OPENAI_API_KEY,
  });

  // Use the clients...
});

import os
from anthropic import Anthropic
from openai import OpenAI

@app.action("ai-action")
async def ai_action(ctx: KernelContext):
    # Access API keys from environment variables
    anthropic = Anthropic(
        api_key=os.environ.get("ANTHROPIC_API_KEY"),
    )

    openai = OpenAI(
        api_key=os.environ.get("OPENAI_API_KEY"),
    )

    # Use the clients...

2. Runtime variables

For use cases where different API keys are needed per invocation (such as platforms using end-user keys), pass the secrets at runtime using the payload parameter. Use encryption standards in your app to protect sensitive data.

import OpenAI from "openai";

app.action('ai-action', async (ctx: KernelContext, payload) => {
  // Decrypt the API key passed at runtime
  const apiKey = decrypt(payload.encryptedApiKey);

  const openai = new OpenAI({
    apiKey: apiKey,
  });

  // Use the client with the user's API key...
});

from openai import OpenAI

@app.action("ai-action")
async def ai_action(ctx: KernelContext, payload):
    # Decrypt the API key passed at runtime
    api_key = decrypt(payload["encryptedApiKey"])

    openai = OpenAI(
        api_key=api_key,
    )

    # Use the client with the user's API key...

​1. Deployment environment variables

​2. Runtime variables

1. Deployment environment variables

2. Runtime variables