Skip to main content
When you create a session, you can pass a secrets dictionary containing API keys and other sensitive values your environment or sandbox needs at runtime:
Your environment’s __init__ method receives these via the secrets parameter:
Rather than exposing raw secret values inside your environment or sandbox, OpenReward replaces them with placeholders before they reach your server. The actual values are injected on egress - when outbound HTTP requests leave the environment or sandbox, OpenReward swaps the placeholders back in for allowed destination hosts only. This means your environment code never handles raw API keys directly, and secrets cannot be leaked to unauthorised hosts.

​
How It Works

  1. The client passes secrets when creating a session
  2. OpenReward stores the real values and replaces them with opaque placeholders
  3. Your environment receives only the placeholders
  4. When an outbound request leaves your environment or sandbox, OpenReward injects the real value - but only if the destination host is allowed

​
Allowed Outbound Hosts

Each secret has a list of allowed hosts that it can be sent to. For common API keys, OpenReward provides sensible defaults: For secrets without defaults, or to override the defaults, pass a (value, [hosts]) tuple instead of a plain string:
Secrets with default allowed hosts can be passed as plain strings. Secrets without defaults must use the (value, [hosts]) format — otherwise the request will be rejected.