[BREAKING] Python: Refine SecretString handling

python/packages/anthropic/agent_framework_anthropic/_bedrock_client.py

@@ -40,11 +40,11 @@ def __init__(
         self,
         *,
         model: str | None = None,
-        aws_secret_key: str | None = None,
-        aws_access_key: str | None = None,
+        aws_secret_key: str | SecretString | None = None,
+        aws_access_key: str | SecretString | None = None,
         aws_region: str | None = None,
         aws_profile: str | None = None,
-        aws_session_token: str | None = None,
+        aws_session_token: str | SecretString | None = None,
         base_url: str | None = None,
         anthropic_client: AsyncAnthropicBedrock | None = None,
         additional_beta_flags: list[str] | None = None,
@@ -118,11 +118,11 @@ def __init__(
         self,
         *,
         model: str | None = None,
-        aws_secret_key: str | None = None,
-        aws_access_key: str | None = None,
+        aws_secret_key: str | SecretString | None = None,
+        aws_access_key: str | SecretString | None = None,
         aws_region: str | None = None,
         aws_profile: str | None = None,
-        aws_session_token: str | None = None,
+        aws_session_token: str | SecretString | None = None,
         base_url: str | None = None,
         anthropic_client: AsyncAnthropicBedrock | None = None,
         additional_beta_flags: list[str] | None = None,

python/packages/anthropic/agent_framework_anthropic/_chat_client.py

@@ -297,7 +297,7 @@ class RawAnthropicClient(
     def __init__(
         self,
         *,
-        api_key: str | None = None,
+        api_key: str | SecretString | None = None,
         model: str | None = None,
         base_url: str | None = None,
         anthropic_client: AnthropicAsyncClient | None = None,
@@ -1671,7 +1671,7 @@ class AnthropicClient(
     def __init__(
         self,
         *,
-        api_key: str | None = None,
+        api_key: str | SecretString | None = None,
         model: str | None = None,
         base_url: str | None = None,
         anthropic_client: AnthropicAsyncClient | None = None,

python/packages/anthropic/agent_framework_anthropic/_foundry_client.py

@@ -40,7 +40,7 @@ def __init__(
         *,
         model: str | None = None,
         resource: str | None = None,
-        api_key: str | None = None,
+        api_key: str | SecretString | None = None,
         azure_ad_token_provider: AnthropicFoundryAzureADTokenProvider | None = None,
         base_url: str | None = None,
         anthropic_client: AsyncAnthropicFoundry | None = None,
@@ -123,7 +123,7 @@ def __init__(
         *,
         model: str | None = None,
         resource: str | None = None,
-        api_key: str | None = None,
+        api_key: str | SecretString | None = None,
         azure_ad_token_provider: AnthropicFoundryAzureADTokenProvider | None = None,
         base_url: str | None = None,
         anthropic_client: AsyncAnthropicFoundry | None = None,

python/packages/anthropic/agent_framework_anthropic/_vertex_client.py

@@ -11,7 +11,7 @@
     FunctionInvocationConfiguration,
     FunctionInvocationLayer,
 )
-from agent_framework._settings import load_settings
+from agent_framework._settings import SecretString, load_settings
 from agent_framework._telemetry import get_user_agent
 from agent_framework.observability import ChatTelemetryLayer
 from anthropic import NOT_GIVEN
@@ -43,7 +43,7 @@ def __init__(
         model: str | None = None,
         region: str | None = None,
         project_id: str | None = None,
-        access_token: str | None = None,
+        access_token: str | SecretString | None = None,
         credentials: GoogleCredentials | None = None,
         base_url: str | None = None,
         anthropic_client: AsyncAnthropicVertex | None = None,
@@ -84,10 +84,13 @@ def __init__(
         if anthropic_client is None:
             resolved_region = region_setting if region_setting is not None else NOT_GIVEN
             resolved_project_id = project_id_setting if project_id_setting is not None else NOT_GIVEN
+            resolved_access_token = (
+                access_token.get_secret_value() if isinstance(access_token, SecretString) else access_token
+            )
             anthropic_client = AsyncAnthropicVertex(
                 region=resolved_region,
                 project_id=resolved_project_id,
-                access_token=access_token,
+                access_token=resolved_access_token,
                 credentials=credentials,
                 base_url=settings.get("anthropic_vertex_base_url"),
                 default_headers={"User-Agent": get_user_agent()},
@@ -116,7 +119,7 @@ def __init__(
         model: str | None = None,
         region: str | None = None,
         project_id: str | None = None,
-        access_token: str | None = None,
+        access_token: str | SecretString | None = None,
         credentials: GoogleCredentials | None = None,
         base_url: str | None = None,
         anthropic_client: AsyncAnthropicVertex | None = None,

python/packages/anthropic/tests/test_anthropic_client.py

@@ -23,7 +23,7 @@
     SupportsChatGetResponse,
     tool,
 )
-from agent_framework._settings import load_settings
+from agent_framework._settings import SecretString, load_settings
 from agent_framework._tools import SHELL_TOOL_KIND_VALUE
 from agent_framework.exceptions import (
     ChatClientException,
@@ -101,17 +101,20 @@ def test_anthropic_settings_init(anthropic_unit_test_env: dict[str, str]) -> Non
     assert settings["chat_model"] == anthropic_unit_test_env["ANTHROPIC_CHAT_MODEL"]
 
 
-def test_anthropic_settings_init_with_explicit_values() -> None:
+@pytest.mark.parametrize("api_key", ["custom-api-key", SecretString("custom-api-key")], ids=["str", "secret"])
+def test_anthropic_settings_init_with_explicit_values(api_key: str | SecretString) -> None:
     """Test AnthropicSettings initialization with explicit values."""
     settings = load_settings(
         AnthropicSettings,
         env_prefix="ANTHROPIC_",
-        api_key="custom-api-key",
+        api_key=api_key,
         chat_model="claude-3-opus-20240229",
     )
 
-    assert settings["api_key"] is not None
+    assert isinstance(settings["api_key"], SecretString)
     assert settings["api_key"].get_secret_value() == "custom-api-key"
+    assert "custom-api-key" not in str(settings["api_key"])
+    assert "custom-api-key" not in repr(settings)
     assert settings["chat_model"] == "claude-3-opus-20240229"
 
 
@@ -160,16 +163,21 @@ def test_agent_accepts_anthropic_clients() -> None:
     assert agent.client is client
 
 
+@pytest.mark.parametrize("secret_type", [str, SecretString], ids=["str", "secret"])
 def test_anthropic_client_init_auto_create_client(
     anthropic_unit_test_env: dict[str, str],
+    secret_type: type[str] | type[SecretString],
 ) -> None:
     """Test AnthropicClient initialization with auto-created anthropic_client."""
     client = AnthropicClient(
-        api_key=anthropic_unit_test_env["ANTHROPIC_API_KEY"],
+        api_key=secret_type(anthropic_unit_test_env["ANTHROPIC_API_KEY"]),
         model=anthropic_unit_test_env["ANTHROPIC_CHAT_MODEL"],
     )
 
-    assert client.anthropic_client is not None
+    anthropic_client = client.anthropic_client
+    assert isinstance(anthropic_client, anthropic_sdk.AsyncAnthropic)
+    assert type(anthropic_client.api_key) is str
+    assert anthropic_client.api_key == anthropic_unit_test_env["ANTHROPIC_API_KEY"]
     assert client.model == anthropic_unit_test_env["ANTHROPIC_CHAT_MODEL"]
 
 

python/packages/anthropic/tests/test_anthropic_provider_clients.py

@@ -4,6 +4,7 @@
 
 import pytest
 from agent_framework import Agent, ChatMiddlewareLayer, FunctionInvocationLayer
+from agent_framework._settings import SecretString
 from agent_framework._telemetry import get_user_agent
 from agent_framework.observability import ChatTelemetryLayer
 
@@ -107,7 +108,10 @@ def test_agent_accepts_anthropic_vertex_clients() -> None:
     assert agent.client is client
 
 
-def test_raw_anthropic_foundry_client_creates_sdk_client_from_settings(tmp_path) -> None:
+@pytest.mark.parametrize("api_key", [None, "test-key", SecretString("test-key")], ids=["env", "str", "secret"])
+def test_raw_anthropic_foundry_client_creates_sdk_client_from_settings(
+    tmp_path, api_key: str | SecretString | None
+) -> None:
     env_file = tmp_path / ".env"
     env_file.write_text(
         "ANTHROPIC_CHAT_MODEL=claude-foundry-test\n"
@@ -119,10 +123,11 @@ def test_raw_anthropic_foundry_client_creates_sdk_client_from_settings(tmp_path)
     with patch(
         "agent_framework_anthropic._foundry_client.AsyncAnthropicFoundry", return_value=mock_transport
     ) as factory:
-        client = RawAnthropicFoundryClient(env_file_path=str(env_file))
+        client = RawAnthropicFoundryClient(api_key=api_key, env_file_path=str(env_file))
 
     assert client.model == "claude-foundry-test"
     assert client.anthropic_client is mock_transport
+    assert type(factory.call_args.kwargs["api_key"]) is str
     factory.assert_called_once_with(
         resource="test-resource",
         api_key="test-key",
@@ -174,16 +179,20 @@ def test_raw_anthropic_foundry_client_requires_resource_or_base_url() -> None:
             RawAnthropicFoundryClient()
 
 
-def test_raw_anthropic_bedrock_client_creates_sdk_client_from_arguments() -> None:
+@pytest.mark.parametrize("secret_type", [str, SecretString], ids=["str", "secret"])
+def test_raw_anthropic_bedrock_client_creates_sdk_client_from_arguments(
+    secret_type: type[str] | type[SecretString],
+) -> None:
     mock_transport = _create_mock_transport("https://bedrock-runtime.us-east-1.amazonaws.com")
 
     with patch(
         "agent_framework_anthropic._bedrock_client.AsyncAnthropicBedrock", return_value=mock_transport
     ) as factory:
         client = RawAnthropicBedrockClient(
             model="claude-bedrock-test",
-            aws_access_key="access-key",
-            aws_secret_key="secret-key",
+            aws_access_key=secret_type("access-key"),
+            aws_secret_key=secret_type("secret-key"),
+            aws_session_token=secret_type("session-token"),
             aws_region="us-east-1",
         )
 
@@ -194,29 +203,36 @@ def test_raw_anthropic_bedrock_client_creates_sdk_client_from_arguments() -> Non
         aws_access_key="access-key",
         aws_region="us-east-1",
         aws_profile=None,
-        aws_session_token=None,
+        aws_session_token="session-token",
         base_url=None,
         default_headers={"User-Agent": get_user_agent()},
     )
+    for key in ("aws_access_key", "aws_secret_key", "aws_session_token"):
+        assert type(factory.call_args.kwargs[key]) is str
 
 
-def test_raw_anthropic_vertex_client_creates_sdk_client_from_arguments() -> None:
+@pytest.mark.parametrize("access_token", ["access-token", SecretString("access-token")], ids=["str", "secret"])
+def test_raw_anthropic_vertex_client_creates_sdk_client_from_arguments(
+    access_token: str | SecretString,
+) -> None:
     mock_transport = _create_mock_transport("https://us-central1-aiplatform.googleapis.com/v1")
 
     with patch("agent_framework_anthropic._vertex_client.AsyncAnthropicVertex", return_value=mock_transport) as factory:
         client = RawAnthropicVertexClient(
             model="claude-vertex-test",
             region="us-central1",
             project_id="test-project",
+            access_token=access_token,
         )
 
     assert client.model == "claude-vertex-test"
     assert client.anthropic_client is mock_transport
     factory.assert_called_once_with(
         region="us-central1",
         project_id="test-project",
-        access_token=None,
+        access_token="access-token",
         credentials=None,
         base_url=None,
         default_headers={"User-Agent": get_user_agent()},
     )
+    assert type(factory.call_args.kwargs["access_token"]) is str

python/packages/azure-ai-search/agent_framework_azure_ai_search/_context_provider.py

@@ -188,7 +188,7 @@ def __init__(
         source_id: str = DEFAULT_SOURCE_ID,
         endpoint: str | None = None,
         index_name: str | None = None,
-        api_key: str | AzureKeyCredential | None = None,
+        api_key: str | SecretString | AzureKeyCredential | None = None,
         credential: AzureCredentialTypes | None = None,
         *,
         mode: Literal["semantic"] = "semantic",
@@ -201,7 +201,7 @@ def __init__(
         model: str | None = None,
         knowledge_base_name: None = None,
         retrieval_instructions: str | None = None,
-        azure_openai_api_key: str | None = None,
+        azure_openai_api_key: str | SecretString | None = None,
         knowledge_base_output_mode: KnowledgeBaseOutputModeLiteral = "extractive_data",
         retrieval_reasoning_effort: RetrievalReasoningEffortLiteral = "minimal",
         query_source_credential: AzureCredentialTypes | None = None,
@@ -243,7 +243,7 @@ def __init__(
         source_id: str = DEFAULT_SOURCE_ID,
         endpoint: str | None = None,
         index_name: str | None = None,
-        api_key: str | AzureKeyCredential | None = None,
+        api_key: str | SecretString | AzureKeyCredential | None = None,
         credential: AzureCredentialTypes | None = None,
         *,
         mode: Literal["agentic"],
@@ -256,7 +256,7 @@ def __init__(
         model: str,
         knowledge_base_name: None = None,
         retrieval_instructions: str | None = None,
-        azure_openai_api_key: str | None = None,
+        azure_openai_api_key: str | SecretString | None = None,
         knowledge_base_output_mode: KnowledgeBaseOutputModeLiteral = "extractive_data",
         retrieval_reasoning_effort: RetrievalReasoningEffortLiteral = "minimal",
         query_source_credential: AzureCredentialTypes | None = None,
@@ -299,7 +299,7 @@ def __init__(
         source_id: str = DEFAULT_SOURCE_ID,
         endpoint: str | None = None,
         index_name: None = None,
-        api_key: str | AzureKeyCredential | None = None,
+        api_key: str | SecretString | AzureKeyCredential | None = None,
         credential: AzureCredentialTypes | None = None,
         *,
         mode: Literal["agentic"],
@@ -312,7 +312,7 @@ def __init__(
         model: str | None = None,
         knowledge_base_name: str,
         retrieval_instructions: str | None = None,
-        azure_openai_api_key: str | None = None,
+        azure_openai_api_key: str | SecretString | None = None,
         knowledge_base_output_mode: KnowledgeBaseOutputModeLiteral = "extractive_data",
         retrieval_reasoning_effort: RetrievalReasoningEffortLiteral = "minimal",
         query_source_credential: AzureCredentialTypes | None = None,
@@ -355,7 +355,7 @@ def __init__(
         source_id: str = DEFAULT_SOURCE_ID,
         endpoint: str | None = None,
         index_name: None = None,
-        api_key: str | AzureKeyCredential | None = None,
+        api_key: str | SecretString | AzureKeyCredential | None = None,
         credential: AzureCredentialTypes | None = None,
         *,
         mode: Literal["agentic"],
@@ -368,7 +368,7 @@ def __init__(
         model: str | None = None,
         knowledge_base_name: None = None,
         retrieval_instructions: str | None = None,
-        azure_openai_api_key: str | None = None,
+        azure_openai_api_key: str | SecretString | None = None,
         knowledge_base_output_mode: KnowledgeBaseOutputModeLiteral = "extractive_data",
         retrieval_reasoning_effort: RetrievalReasoningEffortLiteral = "minimal",
         query_source_credential: AzureCredentialTypes | None = None,
@@ -414,7 +414,7 @@ def __init__(
         source_id: str = DEFAULT_SOURCE_ID,
         endpoint: str | None = None,
         index_name: str | None = None,
-        api_key: str | AzureKeyCredential | None = None,
+        api_key: str | SecretString | AzureKeyCredential | None = None,
         credential: AzureCredentialTypes | None = None,
         *,
         mode: Literal["semantic", "agentic"] = "semantic",
@@ -427,7 +427,7 @@ def __init__(
         model: str | None = None,
         knowledge_base_name: str | None = None,
         retrieval_instructions: str | None = None,
-        azure_openai_api_key: str | None = None,
+        azure_openai_api_key: str | SecretString | None = None,
         knowledge_base_output_mode: KnowledgeBaseOutputModeLiteral = "extractive_data",
         retrieval_reasoning_effort: RetrievalReasoningEffortLiteral = "minimal",
         query_source_credential: AzureCredentialTypes | None = None,
@@ -499,7 +499,7 @@ def __init__(
             endpoint=endpoint,
             index_name=index_name,
             knowledge_base_name=knowledge_base_name,
-            api_key=api_key if isinstance(api_key, str) else None,
+            api_key=api_key if isinstance(api_key, (str, SecretString)) else None,
             env_file_path=env_file_path,
             env_file_encoding=env_file_encoding,
         )
@@ -866,7 +866,9 @@ async def _ensure_knowledge_base(self) -> None:
             resource_url=self.azure_openai_resource_url,
             deployment_name=self.azure_openai_model,
             model_name=self.azure_openai_model,
-            api_key=self.azure_openai_api_key,
+            api_key=self.azure_openai_api_key.get_secret_value()
+            if isinstance(self.azure_openai_api_key, SecretString)
+            else self.azure_openai_api_key,
         )
 
         kb_kwargs: dict[str, Any] = {