Credentials Utilities

credentials — secret store lookup

Method	Purpose	Legacy
get(name, key)	Fetch a single secret value — returns SecretString	read(name, key)
getAll(name)	All secrets under a name — returns SecretDict (Python) / SecretMap (Scala)	read(name)
describe(name)	Credential description
getMetadata(name)	Raw metadata
list()	All credentials

Basic usage

# Python

pwd = synutils.credentials.get("svc-account-a", "password") 
all_secrets = synutils.credentials.getAll("svc-account-a") 
desc = synutils.credentials.describe("svc-account-a") 
print(synutils.credentials.list())
# Backward-compat alias — read() resolves to get()/getAll()
pwd = synutils.credentials.read("svc-account-a", key="password")
all_secrets = synutils.credentials.read("svc-account-a")

// Scala 

val pwd = synutils.credentials.get("svc-account-a", "password") 
val all = synutils.credentials.getAll("svc-account-a") 
val desc = synutils.credentials.describe("svc-account-a") 
println(synutils.credentials.list())

// Backward-compat alias — read() resolves to get()/getAll()
val pwd2 = synutils.credentials.read("svc-account-a", "password")
val all2 = synutils.credentials.read("svc-account-a")

Details

Redaction — values print as ********** by default

get() returns a SecretString; getAll() returns a SecretDict / SecretMap. Both override their string representation so the raw value never leaks into notebook output, logs, or exceptions.

Python

secret = synutils.credentials.get("svc-account-a", "password") 
# All of these print ********** 
print(secret)                  # ********** 
 repr(secret)                  # ********** 
f"connecting with pw={secret}" # connecting with pw=********** 
"%s" % secret                  # ********** 
secret                         # ********** (Jupyter cell last line) 
# Logging is safe too 
logger.info("got %s", secret)  # got ********** 
# Exception messages don't leak 
raise ValueError(secret)       # ValueError: ********** 
# getAll() — every value is redacted 
all_secrets = synutils.credentials.getAll("svc-account-a") 
print(all_secrets) 
# {'user': '**********', 'password': '**********', 'host': '**********'}

Scala

val secret = synutils.credentials.get("svc-account-a", "password") 

// All of these print ********** 
println(secret)         // ********** 
secret.toString         // ********** 
println(s"pw=$secret")  // pw=********** 
secret                  // ********** (REPL last expression) 

// getAll() — every value is redacted 
val all = synutils.credentials.getAll("svc-account-a") 
println(all) 

// Map(user -> **********, password -> **********, host -> **********)

Details

Unseal — getting the raw value for SDK calls

Use .get() (preferred) or .unseal() (legacy alias) on a single SecretString. For a whole SecretDict/SecretMap, use .unseal() to get a plain dict / Map[String, String].

Python — pass to SDKs

import boto3 
# Single value — call .get() or .unseal() 
secret_key = synutils.credentials.get("aws_creds", "secret_access_key") 
client = boto3.client("s3", aws_secret_access_key=secret_key.get()) 
# Whole bag — .unseal() returns a regular dict with raw strings 
raw = synutils.credentials.getAll("aws_creds").unseal() 
client = boto3.client( 
      "s3", 
       aws_access_key_id=raw["access_key"], 
       aws_secret_access_key=raw["secret_key"], 
)

Scala — implicit conversion to String forJDBC/ SDKs

import java.sql.DriverManager 

val pwd = synutils.credentials.get("db_creds", "password") 

// JDBC — implicit conversion to String works directly 
val conn = DriverManager.getConnection(jdbcUrl, "user", pwd) 

// String interpolation — use type ascription to force the conversion 
val urlWithPwd = s"jdbc:postgresql://host/${pwd: String}" 

// Or explicit unseal / get 
val raw: String = pwd.get() // preferred 
val raw2: String = pwd.unseal() // legacy alias 

// Whole bag — .unseal() / .getAll() returns Map[String, String] 
val rawMap: Map[String, String] = synutils.credentials.getAll("db_creds").unseal()

Heads-up — string manipulation reveals the value. SecretString is a string subclass (Python) / has an implicit String conversion (Scala), so anything that touches the underlying characters bypasses redaction:

# Python — these all leak the raw value 
"prefix-" + secret # leaks 
secret + "-suffix" # leaks 
secret[:5] # leaks 
secret.encode() # leaks 
secret.upper() # leaks

// Scala — these force the implicit conversion and leak 
val s: String = secret // leaks (type ascription) 
"prefix-" + secret // leaks (implicit conversion)

Rule of thumb: printing/logging is safe; string manipulation reveals the value. Prefer f-strings / s-interpolation over + concatenation when building log lines.