> ## Documentation Index
> Fetch the complete documentation index at: https://novita.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update a Secret

`Novita.secret``.update()` creates a new immutable version of an existing Secret and makes it active after the value is stored and the policy is persisted. Running executions keep the version and host policy selected at start; newly created, resumed, and cloned executions use the latest active version.

## Prerequisites

```bash CLI icon="terminal" theme={"system"}
export OPENAI_API_KEY="your-openai-api-key"
```

## Example

The example ensures a Secret exists, updates it with `novita.secret.update()`, launches a sandbox that references the updated Secret, uses the placeholder from inside the sandbox, and kills the sandbox when done.

<CodeGroup>
  ```python Python icon="python" theme={"system"}
  import os
  import uuid

  from novita_sandbox import Novita

  secret_name = f"openai-example-{uuid.uuid4().hex[:12]}"
  openai_api_key = os.environ["OPENAI_API_KEY"]
  novita = Novita()

  # Ensure the Secret exists (created once, reused afterwards).
  novita.secret.create(
      name=secret_name,
      value=openai_api_key,
      hosts=["api.openai.com"],
      description="Sandbox Secrets example",
  )

  # Handle secret: update creates a new active version and host policy.
  novita.secret.update(
      name=secret_name,
      value=openai_api_key,
      hosts=["api.openai.com"],
      description="Updated Sandbox Secrets example",
  )

  # Create sandbox: new executions use the latest active version.
  sandbox = novita.sandbox.create(
      secret_envs={"OPENAI_API_KEY": secret_name},
  )

  try:
      # Use the secret: the proxy substitutes the real value for the allow-listed host.
      result = sandbox.commands.run(
          'curl -s https://api.openai.com/v1/models '
          '-H "Authorization: Bearer $OPENAI_API_KEY"'
      )
      print(result.stdout)
  finally:
      # Kill sandbox when done.
      sandbox.kill()
  ```

  ```js JavaScript & TypeScript icon="js" theme={"system"}
  import 'dotenv/config'
  import { randomUUID } from 'crypto'
  import { Novita } from 'novita-sandbox'

  const secretName = `openai-example-${randomUUID().slice(0, 12)}`
  const openaiApiKey = process.env.OPENAI_API_KEY
  const novita = new Novita()

  // Ensure the Secret exists (created once, reused afterwards).
  await novita.secret.create({
    name: secretName,
    value: openaiApiKey,
    hosts: ['api.openai.com'],
    description: 'Sandbox Secrets example',
  })

  // Handle secret: update creates a new active version and host policy.
  await novita.secret.update({
    name: secretName,
    value: openaiApiKey,
    hosts: ['api.openai.com'],
    description: 'Updated Sandbox Secrets example',
  })

  // Create sandbox: new executions use the latest active version.
  const sandbox = await novita.sandbox.create({
    secretEnvs: { OPENAI_API_KEY: secretName },
  })

  try {
    const result = await sandbox.commands.run(
      'curl -s https://api.openai.com/v1/models -H "Authorization: Bearer $OPENAI_API_KEY"'
    )
    console.log(result.stdout)
  } finally {
    await sandbox.kill()
  }
  ```
</CodeGroup>

<Note>
  Each update creates a new immutable version, which becomes active only after the value and policy are persisted. Already-running executions continue using the version selected at start; new, resumed, and cloned executions pick up the latest active version.
</Note>