How do I keep API keys safe inside a Novita Sandbox?

Store the key as a Novita Sandbox Secret and pass it with secret_envs instead of envs. Code in the sandbox only sees a placeholder like novita_secret_<hex>; the real value is added only to HTTPS request headers sent to hosts you allow.

Details

	`envs`	`secret_envs`
What the sandbox sees	The real value	A placeholder (`novita_secret_<hex>`)
Where the real value appears	Anywhere the code puts it	Only in HTTPS request header values (for example `Authorization`, `X-Api-Key`) to allowed hosts
Real value stored in snapshots or templates	Possibly	No
Storage	Passed per sandbox	Encrypted, scoped to your team

Substitution applies to HTTPS header values only — not request bodies, URL paths, query strings, plain HTTP, or WebSocket messages.
The same variable name can’t be used in both envs and secret_envs.
Secrets are available in v2 regions.

How to

import os
from novita_sandbox import Novita

novita = Novita()
novita.secret.create(
    name="openai-key",
    value=os.environ["OPENAI_API_KEY"],
    hosts=["api.openai.com"],
)

sandbox = novita.sandbox.create(secret_envs={"OPENAI_API_KEY": "openai-key"})
print(sandbox.commands.run("echo $OPENAI_API_KEY").stdout)  # prints a placeholder

import { Novita } from 'novita-sandbox'

const novita = new Novita()
await novita.secret.create({
  name: 'openai-key',
  value: process.env.OPENAI_API_KEY,
  hosts: ['api.openai.com'],
})

const sandbox = await novita.sandbox.create({ secretEnvs: { OPENAI_API_KEY: 'openai-key' } })
console.log((await sandbox.commands.run('echo $OPENAI_API_KEY')).stdout) // prints a placeholder

Learn more: Secrets · Use secrets in a sandbox

Last modified on November 11, 2026

⌘I