Guide

Secrets

Secrets are group-scoped key-value stores. Create them once on the sandbox group, then reference them from egress header transforms or telemetry authentication.

Create or update a secret

Secrets live on the sandbox group. Values are not auto-injected as environment variables. Reference them from supported sandbox group configuration such as egress-policy header transforms and OTLP telemetry authentication.

1. Open sandboxes.azure.com/sandbox-groups and select your sandbox group.
2. Select Secrets.
3. Select Create.
4. Enter a name, such as model-credentials.
5. Add key-value pairs, such as API_KEY and MODEL.
6. Select Save. To rotate values later, select the secret, enter replacement values, and save again.

Bash

aca sandboxgroup secret set \
  --name model-credentials \
  --key API_KEY \
  --value sk-test-123

aca sandboxgroup secret set \
  --name model-credentials \
  --key MODEL \
  --value gpt-4

aca sandboxgroup secret set \
  --name model-credentials \
  --key API_KEY \
  --value sk-updated-456

PowerShell

aca sandboxgroup secret set `
  --name model-credentials `
  --key API_KEY `
  --value sk-test-123

aca sandboxgroup secret set `
  --name model-credentials `
  --key MODEL `
  --value gpt-4

aca sandboxgroup secret set `
  --name model-credentials `
  --key API_KEY `
  --value sk-updated-456

SDK

from azure.identity import DefaultAzureCredential
from azure.containerapps.sandbox import SandboxGroupClient, endpoint_for_region

credential = DefaultAzureCredential()
client = SandboxGroupClient(
    endpoint_for_region(ACA_SANDBOXGROUP_REGION),
    credential,
    subscription_id=AZURE_SUBSCRIPTION_ID,
    resource_group=ACA_RESOURCE_GROUP,
    sandbox_group=ACA_SANDBOX_GROUP,
)

client.upsert_secret(
    "model-credentials",
    {"API_KEY": "sk-test-123", "MODEL": "gpt-4"},
)
client.upsert_secret(
    "model-credentials",
    {"API_KEY": "sk-updated-456", "MODEL": "gpt-4o"},
)

List secrets and keys

List secrets to confirm that a name exists. List keys to see which entries are present without reading the stored values.

1. Open the sandbox group and select Secrets.
2. Review the secret list.
3. Select a secret to view its key names.
4. Use the search box to filter by secret name.

Bash

aca sandboxgroup secret show --name model-credentials
aca sandboxgroup secret show --name model-credentials --key API_KEY

PowerShell

aca sandboxgroup secret show --name model-credentials
aca sandboxgroup secret show --name model-credentials --key API_KEY

SDK

for secret in client.list_secrets():
    print(secret.id)

keys = client.list_secret_keys("model-credentials")
print(keys)

Inspect metadata and values

Use metadata checks to confirm the secret shape. Use value reveal or SDK value peek only inside trusted code paths, and avoid printing full values to logs.

Values are masked by default in the portal

The portal detail panel can reveal and copy an individual saved secret value. Handle revealed values carefully, and avoid pasting them into logs or shared channels.

Bash

aca sandboxgroup secret list

PowerShell

aca sandboxgroup secret list

SDK

keys = client.list_secret_keys("model-credentials")
print(keys)

peek = client.peek_secret("model-credentials")
for name, value in (peek.values or {}).items():
    masked = value[:3] + "***" if value else ""
    print(name, masked)

Remove keys or delete a secret

Remove a key to keep the bundle and its remaining values. Delete the bundle only after every sandbox that needs it has moved to a replacement.

1. Open the sandbox group and select Secrets.
2. Select the secret.
3. Select Delete and confirm.

Bash

aca sandboxgroup secret remove \
  --name model-credentials \
  --key MODEL \
  --yes

aca sandboxgroup secret delete \
  --name model-credentials \
  --yes

PowerShell

aca sandboxgroup secret remove `
  --name model-credentials `
  --key MODEL `
  --yes

aca sandboxgroup secret delete `
  --name model-credentials `
  --yes

SDK

client.delete_secret("model-credentials")
client.close()
credential.close()

Related

Sandbox groups

Create the group that stores shared sandbox configuration.

Learn more →

Create sandboxes

Boot a sandbox that can read group-scoped configuration.

Learn more →

Identity

Use managed identity instead of copied Azure credentials.

Learn more →