E2B.Secret reference

CreateSecret

Source: packages/e2b/src/CreateSecret.ts

Store per-user credentials as E2B secrets at runtime, and reference them from a sandbox’s network rules so the sandbox never sees the value.

Secrets created at run time are tagged with the stack, stage and binding (alchemy::stack, alchemy::stage, alchemy::id in their E2B metadata) and are not deleted when the stack is destroyed. List them by those tags to clean them up: secrets.list() returns the ones this binding stored. Metadata you pass to put merges underneath; it never replaces the alchemy::* keys.

CreateSecret: Per-user credentials at egress

const secrets = yield* E2B.CreateSecret();
const sandboxes = yield* E2B.CreateSandbox(Agent);
// in fetch:
const github = yield* secrets.put(`github-${user}`, Redacted.make(token));
const sandbox = yield* sandboxes.create({
  network: {
    allowOut: ["api.github.com"],
    rules: { "api.github.com": [{ transform: { headers: { Authorization: `Bearer ${github.ref}` } } }] },
  },
});

CreateSecretHttp

Source: packages/e2b/src/CreateSecretHttp.ts Kind: Layer · Provides: E2B.CreateSecret

HTTP implementation of CreateSecret. Works on any host.

CreateSecretHttp: Provide the layer

Effect.gen(function* () {
  const secrets = yield* E2B.CreateSecret();
  // ...
}).pipe(Effect.provide(E2B.CreateSecretHttp))

Secret

Source: packages/e2b/src/Secret.ts

An E2B secret: a write-only value that E2B injects into a sandbox’s outbound requests, so code inside the sandbox never sees it.

Reference a secret in a sandbox’s network rules with its ref placeholder (${e2b.secrets.<name>}). E2B resolves the placeholder at egress, on the host, for requests to the domains you list.

Alchemy stamps its stack, stage and logical ID into the secret’s metadata to recognise the secrets it owns.

Secret: Creating a Secret

export const GitHubToken = E2B.Secret("GitHubToken", {
  value: Alchemy.Secret("GITHUB_TOKEN"),
});

Secret: Injecting a Secret at egress

const github = yield* GitHubToken;
const sandbox = yield* sandboxes.create({
  network: {
    allowOut: ["api.github.com"],
    rules: {
      "api.github.com": [{ transform: { headers: { Authorization: `Bearer ${github.ref}` } } }],
    },
  },
});

Secret: Rotating a Secret

Changing value stores a new version in place. Sandboxes resolve the new version on their next request.

const token = yield* E2B.WriteSecret(GitHubToken);
yield* token.put(Redacted.make(freshToken));

Secret: Referencing a secret the stack doesn’t manage

E2B.Secret.lookup finds an existing secret by name. Nothing is created, adopted or deleted.

const github = E2B.Secret.lookup({ name: "github-token" });
const token = yield* E2B.WriteSecret(github);

WriteSecret

Source: packages/e2b/src/WriteSecret.ts

Rotate a declared Secret at runtime: a scheduled job refreshing a short-lived token, or a webhook storing a reissued credential. Sandboxes resolve the new version on their next request.

A later deploy stores the declared value again only when that value changes.

WriteSecret: Rotating a secret

const token = yield* E2B.WriteSecret(GitHubToken);
// in a scheduled handler:
yield* token.put(Redacted.make(fresh));

WriteSecretHttp

Source: packages/e2b/src/WriteSecretHttp.ts Kind: Layer · Provides: E2B.WriteSecret

HTTP implementation of WriteSecret. Works on any host.

WriteSecretHttp: Provide the layer

Effect.gen(function* () {
  const token = yield* E2B.WriteSecret(GitHubToken);
  // ...
}).pipe(Effect.provide(E2B.WriteSecretHttp))