Pattern for having Toolbox instances use secrets without passing them in logged configuration

[simonw]

Refs:

• Authentication mechanism llm-tools-datasette#2
• Toolbox instantiation should be logged to DB when logging toolbox methods #1089

[simonw]

One possible design:

llm chat -T 'Datasette("https://private.datasette.io/content", key="private-datasette"})'

This would not require additional code in core, it could be a convention that plugins know how to look things up in LLM keys.

(I originally had secret="name-of-key" but using key= is more consistent with how things are named already.)

[simonw]

The llm.get_key() method is currently undocumented and confusing to use:

>>> import llm
>>> llm.get_key("hi")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: get_key() missing 1 required positional argument: 'key_alias'
>>> help(llm.get_key)

>>> llm.get_key(key_alias="hi")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: get_key() missing 1 required positional argument: 'explicit_key'
>>> help(llm.get_key)

>>> llm.get_key(None, key_alias="hi")
>>> llm.get_key(None, key_alias="openai")
'sk-proj...

[simonw]

Now that llm.get_key() is documented I'm going to suggest people use that.