Skip to main content

Accounts & secrets

When orchestration schedules a job per (pipeline, network), it needs two things it must never hard-code: which accounts to run, and which credentials to use. Both come from external providers, resolved at run time — an HTTP API in production, or a local file for development.

Two providers​

ProviderSource (API first, else a file)Holds
AccountsSTREAMWRIGHT_ACCOUNTS_URL → STREAMWRIGHT_ACCOUNTS_FILE (default ~/.streamwright/accounts.yaml)the (user, account, network) rows — each with its own token
SecretsSTREAMWRIGHT_SECRETS_URL → STREAMWRIGHT_SECRETS_FILE (default ~/.streamwright/secrets.yaml)per-network app credentials, by region — no tokens
Files are for development

A local file is the dev/testing path. In production both providers are the same API: STREAMWRIGHT_ACCOUNTS_URL / STREAMWRIGHT_SECRETS_URL return the same documents over HTTPS.

Accounts​

A clients map groups accounts under a client (the user_id). Each account carries its own token — so tokens live on the account, never in the secrets provider. The client's region selects which region's secrets a run uses.

~/.streamwright/accounts.yaml
clients:
  client_a:
    name: Example Client
    region: region_a
    accounts:
      - network: network_a
        account_id: "account-1"
        token: "<account-token>"
        timezone: UTC

A flat accounts: list of rows is also accepted for quick dev.

Secrets​

App-level credentials per network, with an optional default plus per-region overlay. No tokens here.

~/.streamwright/secrets.yaml
secrets:
  network_a:
    default:
      api_key: "<api-key>"
      api_secret: "<api-secret>"
    regions:
      region_b:
        api_key: "<region-b-api-key>"   # overlays default

Mapping: network + region → credentials​

For each account row, the orchestrator resolves the network's credentials at the account's region (the region's values overlaid on default), and takes the token from the account itself.

Into streamwright run​

A network's inputs map those values onto the inputs the source declares, as a small template over row.* (the account) and app.* (the resolved credentials):

networks/network_a.yaml (excerpt)
inputs:
  account_ids: "{{ row.account_id }}"
  api_key:     "secret:{{ app.api_key }}"
  token:       "secret:{{ row.token }}"     # the token comes from the account

A value starting with secret: reaches streamwright only as an STREAMWRIGHT_SECRET_<NAME> environment variable — never on the command line, in run config, or in logs (see the CLI's secret handling). Everything else is a plain --set. This keeps the streamwright CLI completely network-agnostic: the orchestration layer does the account and region resolution, then hands it a flat set of inputs.