Fetch a secret with the Python SDK

The 1Claw Python SDK ships as the PyPI package oneclaw. You create a client with an API key, and it handles token exchange and refresh for you.

1. 1

   Create and activate a virtual environment.

   bash Copy

   python3 -m venv .venv
   source .venv/bin/activate

2. 2

   Install the SDK from PyPI.

   bash Copy

   pip install oneclaw

3. 3

   Export your API key and the vault ID that holds a secret. Replace 1ck_your_user_key with your 1ck_ key from Settings → API Keys. Use your vault UUID from 1claw vault list or the Foundations track.

   bash Copy

   export ONECLAW_API_KEY=1ck_your_user_key
   export ONECLAW_VAULT_ID=your-vault-uuid

4. 4

   Write the following script and save it as fetch_secret.py. It creates a client and reads one secret by path.

   python Copy

   import os
   from oneclaw import create_client
   
   client = create_client(api_key=os.environ["ONECLAW_API_KEY"])
   vault_id = os.environ["ONECLAW_VAULT_ID"]
   
   secret = client.secrets.get(vault_id, "api-keys/openai")
   print(secret.data["value"])

5. 5

   Create the secret if it doesn't already exist.

   bash Copy

   1claw secret set api-keys/openai --vault $ONECLAW_VAULT_ID --value 'your-openai-key' --type api_key

6. 6

   Run it. The fetched secret value prints to your terminal.

   bash Copy

   python fetch_secret.py

You now have a Python script that authenticates to 1Claw and prints a real secret pulled from your vault.

What this gives you, and what it does not. The Python client mirrors the TypeScript one in shape while following Python conventions, and the differences catch people who move between them.

• Resource names differ deliberately. Python exposes client.vaults and snake_case methods; TypeScript uses client.vault and camelCase. Neither is a typo for the other.
• The response envelope is the same. Calls return an object with data and error, so reading resp.data['value'] rather than treating the result as the value itself is the habit to build.
• It does not manage your process environment. Fetching a secret gives you a value in memory; putting it into os.environ is a decision you are making, and one that widens its reach to every library in the process.