Keeper Secrets Manager Core is the Python SDK for Keeper's cloud-based, zero-knowledge secrets management platform. It allows developers to securely access and manage sensitive credentials like API keys, database passwords, and SSH keys in CI/CD pipelines, containers, and automation scripts. The library is actively maintained with frequent updates, with the current stable version being 17.2.0.
pip install keeper-secrets-manager-coreVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to initialize the `SecretsManager` using a one-time access token (preferably from an environment variable) and retrieve secrets. The one-time token is used for initial device registration and configuration file creation (e.g., `client-config.json`). After the initial setup, the SDK can often be initialized without the token, relying on the local configuration.
Upgrade Python to 3.9 or higher. If unable to upgrade Python, ensure `pip` installs `keeper-secrets-manager-core<17.2.0`.
Ensure `client-config.json` retains secure permissions. Environment variables like `KSM_CONFIG_SKIP_MODE` or `KSM_CONFIG_SKIP_MODE_WARNING` can be used to disable permission checking or warnings if necessary.
Consult your IT team to allow Keeper traffic (to `keepersecurity.com`, `keepersecurity.eu`, etc.) through firewalls without interception. Ensure `verify_ssl_certs` and `proxy_url` parameters are correctly configured for file operations if a proxy is used.
Verify that records intended for use with Secrets Manager are 'typed'. Records can be identified as non-typed if they lack a 'Type' field or by using `ls -l` in Keeper Commander CLI.
Generate a new one-time access token from the Keeper Web Vault or Keeper Commander CLI and retry initialization. The token is typically only needed for the *first* initialization to create the local configuration file.
Allow direct access to Keeper security domains (`keepersecurity.com`, etc.) through your firewall/proxy. If using a proxy, ensure `verify_ssl_certs` and `proxy_url` are configured correctly.
Ensure the record is a 'typed' record (V3) and that the configured device has appropriate permissions to access it. Verify the record UID is correct.
Verify that the Secrets Manager add-on is active on your Keeper Account and that the role used by the application/device has the Secrets Manager enforcement policy enabled in the Admin Console.
Implement retry logic with exponential backoff in your application to handle throttled requests. Review application design to minimize rapid, repetitive API calls from a single device ID.
Use the `secret.field('field_name', single=True)` method for standard fields, or iterate if expecting multiple values. Refer to the SDK documentation for correct field access patterns.