Manage secrets

A managed secret stores a credential for jobs, compute profiles, or catalogs. LakeSail encrypts the value and never shows it again after you save it. When a runtime starts, LakeSail resolves the reference and passes the value to the workload.

Use a managed secret instead of entering credentials as literal environment variables. Anyone who can run code in the workload may read its environment, so do not print secret-backed variables or include them in logs.

Create a secret

1. Open Settings → Secrets.
2. Click Add Secret.
3. Enter a Name. Names are unique within the organization and are not case-sensitive.
4. Add an optional Description.
5. Select every Team that will use the secret.
6. Paste the Secret Value and click Create Secret.

Only platform-managed secrets are currently available. The value is encrypted and cannot be viewed after creation. To correct it later, replace the value.

Use a secret in an environment variable

You can add environment variables to a compute profile, a job, or a catalog:

1. Open the resource for editing.
2. Under Environment Variables, click Add Variable.
3. Enter the variable name, such as OPENAI_API_KEY.
4. Change the value type from Literal to Secret.
5. Select the secret and save the resource.

Compute profile variables apply to jobs, sessions, and notebooks that use the profile. A job variable with the same name overrides the profile value.

The secret must be shared with every team that can use the resource. For a compute profile, this means every team linked to its cluster. Unavailable secrets remain disabled in the selector.

Use a secret for catalog credentials

Catalog credential fields also use managed secrets:

• Iceberg REST: OAuth or bearer access token.
• Unity Catalog: personal access token.
• OneLake: bearer token.

Create the secret first, then select it in the catalog form. The secret must be shared with every team assigned to the catalog.

Use secrets inside JSON

Choose JSON for an environment variable when its value is a JSON object or array containing one or more credentials. In the editor, place a secret reference where the resolved value should appear:

{
  "endpoint": "https://example.com",
  "token": {
    "type": "secretRef",
    "secretId": "SEC123"
  }
}

Get the secret ID with ListSecrets in the API Reference. LakeSail replaces each reference and passes the rendered JSON as the environment variable value.

When using the API directly, wrap the JSON value as a jsonTemplate:

{
  "CONNECTOR_CONFIG": {
    "type": "jsonTemplate",
    "value": {
      "token": {
        "type": "secretRef",
        "secretId": "SEC123"
      }
    }
  }
}

Change team access

Edit a secret to add or remove teams. A team cannot be removed if a job, catalog, or compute profile would lose access to a referenced secret.

Before adding a team to a resource that uses a secret, add that team to the secret. Then update the resource.

Replace a value

1. Open Settings → Secrets.
2. Choose Edit Secret.
3. Enter a Replacement Value and save.

Replacing the value creates a new version without changing the secret ID or its references. New runtimes use the replacement. Running jobs, sessions, and notebooks keep the value they started with; start a new run or restart the session or notebook to use the new value.

References always use the latest active version.

Revoke or delete a secret

• Revoke Current Value prevents new runtimes from resolving the secret. Existing runtimes keep the value already passed to them. Add a replacement value before starting more work.
• Delete Secret removes the secret. You can delete it only after removing every reference from jobs, catalogs, compute profiles, and JSON templates.

Use revoke when a value may be compromised. Use delete when the secret is no longer needed.

API reference

• Secrets: create, list, update, replace, revoke, and delete managed secrets.
• Jobs: job environment variables can reference secrets.
• Catalogs: catalog credentials and runtime environment variables can reference secrets.