> This page is for version 0.5.1.
> For other versions, use one of these documentation indexes:
> - Main (default): https://docs.nvidia.com/nemo/gym/main/llms.txt
> - 0.7.0: https://docs.nvidia.com/nemo/gym/v0.7.0/llms.txt
> - 0.6.0: https://docs.nvidia.com/nemo/gym/v0.6.0/llms.txt
> - 0.5.1: https://docs.nvidia.com/nemo/gym/v0.5.1/llms.txt
> - 0.5.0: https://docs.nvidia.com/nemo/gym/v0.5.0/llms.txt
> - 0.4.0: https://docs.nvidia.com/nemo/gym/v0.4.0/llms.txt
> - 0.3.0: https://docs.nvidia.com/nemo/gym/v0.3.0/llms.txt
> - 0.2.1: https://docs.nvidia.com/nemo/gym/v0.2.1/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo/gym/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo/gym/_mcp/server.

# nemo_gym.config.secret_utils

## Module Contents

### Functions

| Name                                                                                   | Description                                                                                                   |
| -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| [`hide_secrets_in_container`](#nemo_gym-config-secret_utils-hide_secrets_in_container) | Return the credential-safe config projection shared by saved artifacts and exporters.                         |
| [`hide_secrets_in_overrides`](#nemo_gym-config-secret_utils-hide_secrets_in_overrides) | Mask `+key=value` / `++key=value` tokens whose key looks secret-shaped.                                       |
| [`looks_like_secret_key`](#nemo_gym-config-secret_utils-looks_like_secret_key)         | -                                                                                                             |
| [`mask_url_passwords`](#nemo_gym-config-secret_utils-mask_url_passwords)               | Mask the password in the user info of every URL inside `text`, keeping the user name and the rest of the URL. |
| [`recursively_hide_secrets`](#nemo_gym-config-secret_utils-recursively_hide_secrets)   | Mask every secret-shaped leaf in place with '\*\*\*\*' so a config can be printed or exported.                |

### Data

[`MASKED_VALUE`](#nemo_gym-config-secret_utils-MASKED_VALUE)

[`_CAPTURE_PUBLIC_FIELDS`](#nemo_gym-config-secret_utils-_CAPTURE_PUBLIC_FIELDS)

[`_SECRET_KEY_SUBSTRINGS`](#nemo_gym-config-secret_utils-_SECRET_KEY_SUBSTRINGS)

[`_URL_PASSWORD`](#nemo_gym-config-secret_utils-_URL_PASSWORD)

### API

```python
nemo_gym.config.secret_utils.hide_secrets_in_container(
    data: typing.Any
) -> typing.Any
```

Return the credential-safe config projection shared by saved artifacts and exporters.

Preserve unresolved interpolations without evaluating them. Secret ancestry masks every value,
including arbitrary names in a `secrets` mapping. The root `token_id_capture` mapping is a
settings namespace, not a credential; its own secret-shaped children still undergo masking.
Custom sink/resolver kwargs can contain credentials under arbitrary names, so their values stay masked.

```python
nemo_gym.config.secret_utils.hide_secrets_in_overrides(
    tokens: typing.List[str]
) -> typing.List[str]
```

Mask `+key=value` / `++key=value` tokens whose key looks secret-shaped.

```python
nemo_gym.config.secret_utils.looks_like_secret_key(
    key: object
) -> bool
```

```python
nemo_gym.config.secret_utils.mask_url_passwords(
    text: str
) -> str
```

Mask the password in the user info of every URL inside `text`, keeping the user name and the rest of the URL.

Only a precaution for a credential pasted into a URL: it is the user's job to keep secrets out of the config
in the first place (behind `${oc.env:NAME}` or `env.yaml`). A password that is an interpolation is a reference
rather than a secret, so it stays as it is.

```python
nemo_gym.config.secret_utils.recursively_hide_secrets(
    dict_config: omegaconf.DictConfig
) -> None
```

Mask every secret-shaped leaf in place with '\*\*\*\*' so a config can be printed or exported.

A leaf is secret-shaped by its own name, or by sitting anywhere below a secret-shaped key: every
value of a `secrets:` mapping is a secret whatever its environment variable is called.

Used by the config parser and the exporters.

```python
nemo_gym.config.secret_utils.MASKED_VALUE = '****'
```

```python
nemo_gym.config.secret_utils._CAPTURE_PUBLIC_FIELDS = frozenset({'enabled', 'all_agents', 'dir', 'sink', 'lineage_store', 'rebuild_res...
```

```python
nemo_gym.config.secret_utils._SECRET_KEY_SUBSTRINGS = ('token', 'key', 'header', 'password', 'passwd', 'secret', 'credential', 'bearer...
```

```python
nemo_gym.config.secret_utils._URL_PASSWORD = re.compile('(?P<head>[A-Za-z][A-Za-z0-9+.\\-]*://(?:\\$\\{[^}]*\\}|[^\\s/?#:@$])...
```