st.secrets gives a Streamlit app dictionary-like access to confidential configuration, such as API keys, passwords, and cloud-service credentials, without placing those values in Python code. section 5.3.4
For local development, place values in .streamlit/secrets.toml. Keep that file out of version control, and configure the secrets directly in Streamlit Community Cloud for deployment. section 5.3.4
Use a nested TOML structure when a service has grouped credentials:
- Define a section such as [jokes_api] and put api_key inside it. section 5.3.4
- Read the value with st.secrets["jokes_api"]["api_key"]. section 5.3.4
- Pass the retrieved key to the function that calls the external API rather than hard-coding it. section 5.3.4
Generating BigQuery configuration
A Google Cloud service-account JSON file can be loaded into a Python dictionary and written to .streamlit/secrets.toml under a [bigquery] section. The app can then use st.secrets to access the credentials needed for BigQuery. section 7.7.2
Listing 5.2 The secrets.toml file
[jokes_api] api_key = "+4VJR..."
Inspect the minimal secrets.toml shape: a service section contains an api_key value that becomes a nested dictionary lookup. section 5.3.4
