chore: use SecretStr for x-llamastack-provider-data keys (#4939)

mattf · web-flow · commit b458b8bcbd2a · 2026-02-20T08:08:27.000-05:00
closes #4391
diff --git a/src/llama_stack/providers/inline/scoring/braintrust/__init__.py b/src/llama_stack/providers/inline/scoring/braintrust/__init__.py
@@ -5,15 +5,15 @@
 # the root directory of this source tree.
 from typing import Any
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 from llama_stack.core.datatypes import Api
 
 from .config import BraintrustScoringConfig
 
 
 class BraintrustProviderDataValidator(BaseModel):
-    openai_api_key: str
+    openai_api_key: SecretStr
 
 
 async def get_provider_impl(
diff --git a/src/llama_stack/providers/remote/inference/anthropic/config.py b/src/llama_stack/providers/remote/inference/anthropic/config.py
@@ -6,14 +6,14 @@
 
 from typing import Any
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class AnthropicProviderDataValidator(BaseModel):
-    anthropic_api_key: str | None = Field(
+    anthropic_api_key: SecretStr | None = Field(
         default=None,
         description="API key for Anthropic models",
     )
diff --git a/src/llama_stack/providers/remote/inference/azure/config.py b/src/llama_stack/providers/remote/inference/azure/config.py
@@ -7,14 +7,14 @@
 import os
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class AzureProviderDataValidator(BaseModel):
-    azure_api_key: str = Field(
+    azure_api_key: SecretStr = Field(
         description="Azure API key for Azure",
     )
     azure_api_base: HttpUrl = Field(
diff --git a/src/llama_stack/providers/remote/inference/bedrock/config.py b/src/llama_stack/providers/remote/inference/bedrock/config.py
@@ -6,13 +6,13 @@
 
 import os
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 
 
 class BedrockProviderDataValidator(BaseModel):
-    aws_bearer_token_bedrock: str | None = Field(
+    aws_bearer_token_bedrock: SecretStr | None = Field(
         default=None,
         description="API Key (Bearer token) for Amazon Bedrock",
     )
diff --git a/src/llama_stack/providers/remote/inference/cerebras/config.py b/src/llama_stack/providers/remote/inference/cerebras/config.py
@@ -7,7 +7,7 @@
 import os
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
@@ -16,7 +16,7 @@
 
 
 class CerebrasProviderDataValidator(BaseModel):
-    cerebras_api_key: str | None = Field(
+    cerebras_api_key: SecretStr | None = Field(
         default=None,
         description="API key for Cerebras models",
     )
diff --git a/src/llama_stack/providers/remote/inference/databricks/config.py b/src/llama_stack/providers/remote/inference/databricks/config.py
@@ -13,7 +13,7 @@
 
 
 class DatabricksProviderDataValidator(BaseModel):
-    databricks_api_token: str | None = Field(
+    databricks_api_token: SecretStr | None = Field(
         default=None,
         description="API token for Databricks models",
     )
diff --git a/src/llama_stack/providers/remote/inference/fireworks/__init__.py b/src/llama_stack/providers/remote/inference/fireworks/__init__.py
@@ -4,13 +4,13 @@
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 from .config import FireworksImplConfig
 
 
 class FireworksProviderDataValidator(BaseModel):
-    fireworks_api_key: str
+    fireworks_api_key: SecretStr
 
 
 async def get_adapter_impl(config: FireworksImplConfig, _deps):
diff --git a/src/llama_stack/providers/remote/inference/gemini/config.py b/src/llama_stack/providers/remote/inference/gemini/config.py
@@ -6,14 +6,14 @@
 
 from typing import Any
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class GeminiProviderDataValidator(BaseModel):
-    gemini_api_key: str | None = Field(
+    gemini_api_key: SecretStr | None = Field(
         default=None,
         description="API key for Gemini models",
     )
diff --git a/src/llama_stack/providers/remote/inference/groq/config.py b/src/llama_stack/providers/remote/inference/groq/config.py
@@ -6,14 +6,14 @@
 
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class GroqProviderDataValidator(BaseModel):
-    groq_api_key: str | None = Field(
+    groq_api_key: SecretStr | None = Field(
         default=None,
         description="API key for Groq models",
     )
diff --git a/src/llama_stack/providers/remote/inference/llama_openai_compat/config.py b/src/llama_stack/providers/remote/inference/llama_openai_compat/config.py
@@ -6,14 +6,14 @@
 
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class LlamaProviderDataValidator(BaseModel):
-    llama_api_key: str | None = Field(
+    llama_api_key: SecretStr | None = Field(
         default=None,
         description="API key for api.llama models",
     )
diff --git a/src/llama_stack/providers/remote/inference/nvidia/config.py b/src/llama_stack/providers/remote/inference/nvidia/config.py
@@ -7,14 +7,14 @@
 import os
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class NVIDIAProviderDataValidator(BaseModel):
-    nvidia_api_key: str | None = Field(
+    nvidia_api_key: SecretStr | None = Field(
         default=None,
         description="API key for NVIDIA NIM models",
     )
diff --git a/src/llama_stack/providers/remote/inference/openai/config.py b/src/llama_stack/providers/remote/inference/openai/config.py
@@ -6,14 +6,14 @@
 
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class OpenAIProviderDataValidator(BaseModel):
-    openai_api_key: str | None = Field(
+    openai_api_key: SecretStr | None = Field(
         default=None,
         description="API key for OpenAI models",
     )
diff --git a/src/llama_stack/providers/remote/inference/passthrough/__init__.py b/src/llama_stack/providers/remote/inference/passthrough/__init__.py
@@ -4,14 +4,14 @@
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 from .config import PassthroughImplConfig
 
 
 class PassthroughProviderDataValidator(BaseModel):
     passthrough_url: str
-    passthrough_api_key: str
+    passthrough_api_key: SecretStr
 
 
 async def get_adapter_impl(config: PassthroughImplConfig, _deps):
diff --git a/src/llama_stack/providers/remote/inference/passthrough/passthrough.py b/src/llama_stack/providers/remote/inference/passthrough/passthrough.py
@@ -103,7 +103,7 @@ def _get_passthrough_api_key(self) -> str:
             raise ValueError(
                 'Pass API Key for the passthrough endpoint in the header X-LlamaStack-Provider-Data as { "passthrough_api_key": <your api key>}'
             )
-        return provider_data.passthrough_api_key
+        return provider_data.passthrough_api_key.get_secret_value()
 
     async def openai_completion(
         self,
diff --git a/src/llama_stack/providers/remote/inference/runpod/config.py b/src/llama_stack/providers/remote/inference/runpod/config.py
@@ -13,7 +13,7 @@
 
 
 class RunpodProviderDataValidator(BaseModel):
-    runpod_api_token: str | None = Field(
+    runpod_api_token: SecretStr | None = Field(
         default=None,
         description="API token for RunPod models",
     )
diff --git a/src/llama_stack/providers/remote/inference/sambanova/config.py b/src/llama_stack/providers/remote/inference/sambanova/config.py
@@ -6,14 +6,14 @@
 
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
 
 
 class SambaNovaProviderDataValidator(BaseModel):
-    sambanova_api_key: str | None = Field(
+    sambanova_api_key: SecretStr | None = Field(
         default=None,
         description="Sambanova Cloud API key",
     )
diff --git a/src/llama_stack/providers/remote/inference/together/__init__.py b/src/llama_stack/providers/remote/inference/together/__init__.py
@@ -4,13 +4,13 @@
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 from .config import TogetherImplConfig
 
 
 class TogetherProviderDataValidator(BaseModel):
-    together_api_key: str
+    together_api_key: SecretStr
 
 
 async def get_adapter_impl(config: TogetherImplConfig, _deps):
diff --git a/src/llama_stack/providers/remote/inference/together/together.py b/src/llama_stack/providers/remote/inference/together/together.py
@@ -55,7 +55,7 @@ def _get_client(self) -> AsyncTogether:
                 raise ValueError(
                     'Pass Together API Key in the header X-LlamaStack-Provider-Data as { "together_api_key": <your api key>}'
                 )
-            together_api_key = provider_data.together_api_key
+            together_api_key = provider_data.together_api_key.get_secret_value()
         return AsyncTogether(api_key=together_api_key)
 
     async def list_provider_model_ids(self) -> Iterable[str]:
diff --git a/src/llama_stack/providers/remote/inference/vllm/__init__.py b/src/llama_stack/providers/remote/inference/vllm/__init__.py
@@ -4,13 +4,13 @@
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 from .config import VLLMInferenceAdapterConfig
 
 
 class VLLMProviderDataValidator(BaseModel):
-    vllm_api_token: str | None = None
+    vllm_api_token: SecretStr | None = None
 
 
 async def get_adapter_impl(config: VLLMInferenceAdapterConfig, _deps):
diff --git a/src/llama_stack/providers/remote/inference/watsonx/config.py b/src/llama_stack/providers/remote/inference/watsonx/config.py
@@ -7,7 +7,7 @@
 import os
 from typing import Any
 
-from pydantic import BaseModel, Field, HttpUrl
+from pydantic import BaseModel, Field, HttpUrl, SecretStr
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack_api import json_schema_type
@@ -18,7 +18,7 @@ class WatsonXProviderDataValidator(BaseModel):
         default=None,
         description="IBM WatsonX project ID",
     )
-    watsonx_api_key: str | None = None
+    watsonx_api_key: SecretStr | None = None
 
 
 @json_schema_type
diff --git a/src/llama_stack/providers/remote/safety/sambanova/config.py b/src/llama_stack/providers/remote/safety/sambanova/config.py
@@ -12,7 +12,7 @@
 
 
 class SambaNovaProviderDataValidator(BaseModel):
-    sambanova_api_key: str | None = Field(
+    sambanova_api_key: SecretStr | None = Field(
         default=None,
         description="Sambanova Cloud API key",
     )
diff --git a/src/llama_stack/providers/remote/tool_runtime/bing_search/__init__.py b/src/llama_stack/providers/remote/tool_runtime/bing_search/__init__.py
@@ -8,11 +8,11 @@
 from .config import BingSearchToolConfig
 
 __all__ = ["BingSearchToolConfig", "BingSearchToolRuntimeImpl"]
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 
 class BingSearchToolProviderDataValidator(BaseModel):
-    bing_search_api_key: str
+    bing_search_api_key: SecretStr
 
 
 async def get_adapter_impl(config: BingSearchToolConfig, _deps):
diff --git a/src/llama_stack/providers/remote/tool_runtime/bing_search/bing_search.py b/src/llama_stack/providers/remote/tool_runtime/bing_search/bing_search.py
@@ -46,7 +46,7 @@ def _get_api_key(self) -> str:
             raise ValueError(
                 'Pass Bing Search API Key in the header X-LlamaStack-Provider-Data as { "bing_search_api_key": <your api key>}'
             )
-        return provider_data.bing_search_api_key
+        return provider_data.bing_search_api_key.get_secret_value()
 
     async def list_runtime_tools(
         self,
diff --git a/src/llama_stack/providers/remote/tool_runtime/brave_search/__init__.py b/src/llama_stack/providers/remote/tool_runtime/brave_search/__init__.py
@@ -4,14 +4,14 @@
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 from .brave_search import BraveSearchToolRuntimeImpl
 from .config import BraveSearchToolConfig
 
 
 class BraveSearchToolProviderDataValidator(BaseModel):
-    brave_search_api_key: str
+    brave_search_api_key: SecretStr
 
 
 async def get_adapter_impl(config: BraveSearchToolConfig, _deps):
diff --git a/src/llama_stack/providers/remote/tool_runtime/brave_search/brave_search.py b/src/llama_stack/providers/remote/tool_runtime/brave_search/brave_search.py
@@ -44,7 +44,7 @@ def _get_api_key(self) -> str:
             raise ValueError(
                 'Pass Search provider\'s API Key in the header X-LlamaStack-Provider-Data as { "brave_search_api_key": <your api key>}'
             )
-        return provider_data.brave_search_api_key
+        return provider_data.brave_search_api_key.get_secret_value()
 
     async def list_runtime_tools(
         self,
diff --git a/src/llama_stack/providers/remote/tool_runtime/tavily_search/__init__.py b/src/llama_stack/providers/remote/tool_runtime/tavily_search/__init__.py
@@ -4,14 +4,14 @@
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 
 from .config import TavilySearchToolConfig
 from .tavily_search import TavilySearchToolRuntimeImpl
 
 
 class TavilySearchToolProviderDataValidator(BaseModel):
-    tavily_search_api_key: str
+    tavily_search_api_key: SecretStr
 
 
 async def get_adapter_impl(config: TavilySearchToolConfig, _deps):
diff --git a/src/llama_stack/providers/remote/tool_runtime/tavily_search/tavily_search.py b/src/llama_stack/providers/remote/tool_runtime/tavily_search/tavily_search.py
@@ -45,7 +45,7 @@ def _get_api_key(self) -> str:
             raise ValueError(
                 'Pass Search provider\'s API Key in the header X-LlamaStack-Provider-Data as { "tavily_search_api_key": <your api key>}'
             )
-        return provider_data.tavily_search_api_key
+        return provider_data.tavily_search_api_key.get_secret_value()
 
     async def list_runtime_tools(
         self,
diff --git a/src/llama_stack/providers/remote/tool_runtime/wolfram_alpha/__init__.py b/src/llama_stack/providers/remote/tool_runtime/wolfram_alpha/__init__.py
diff --git a/src/llama_stack/providers/remote/tool_runtime/wolfram_alpha/wolfram_alpha.py b/src/llama_stack/providers/remote/tool_runtime/wolfram_alpha/wolfram_alpha.py
diff --git a/src/llama_stack/providers/utils/inference/litellm_openai_mixin.py b/src/llama_stack/providers/utils/inference/litellm_openai_mixin.py
diff --git a/src/llama_stack/providers/utils/inference/openai_mixin.py b/src/llama_stack/providers/utils/inference/openai_mixin.py
diff --git a/tests/unit/providers/inference/test_bedrock_adapter.py b/tests/unit/providers/inference/test_bedrock_adapter.py
diff --git a/tests/unit/providers/inference/test_litellm_openai_mixin.py b/tests/unit/providers/inference/test_litellm_openai_mixin.py
diff --git a/tests/unit/providers/test_provider_data_secretstr.py b/tests/unit/providers/test_provider_data_secretstr.py
diff --git a/tests/unit/providers/utils/inference/test_openai_mixin.py b/tests/unit/providers/utils/inference/test_openai_mixin.py

Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,7 @@`
`13`	`13`
`14`	`14`
`15`	`15`	`class DatabricksProviderDataValidator(BaseModel):`
`16`		`- databricks_api_token: str \| None = Field(`
	`16`	`+ databricks_api_token: SecretStr \| None = Field(`
`17`	`17`	`default=None,`
`18`	`18`	`description="API token for Databricks models",`
`19`	`19`	`)`