Secrets & Config

How Config Works

Each connector declares its config schema in config.yaml. Values resolve at runtime — no env vars needed.

Resolution Order

1. config.yaml environments — URLs and settings per environment
2. AWS Secrets Manager — secrets at mesh/{env}/{secret_key}
3. .secrets.yaml — local dev fallback (gitignored)

Usage in Code

from mesh.config.secrets import resolve_connector_config

config = resolve_connector_config("fast-query")
# {"base_url": "https://stage-...", "user_id": "8e86...", ...}

One function call. Environment-aware. No env vars.

Config Schema Types

Type	Where it lives	Example
url	config.yaml per environment	Base URLs
string	config.yaml default value	User roles, settings
secret	AWS SM or .secrets.yaml	API tokens, credentials

Environment

Set MESH_ENV to control which URLs resolve:

MESH_ENV	Effect
dev (default)	Uses stage URLs
stage	Uses stage URLs
prod	Uses production URLs

Local Secrets

For local development, add secrets to .secrets.yaml:

fast-chat-api/user-id: "8e86186b-..."
fast-chat-api/user-email: "user@example.com"
consumer-agent/user-id: "67800c1c..."

This file is gitignored. In production, secrets resolve from AWS Secrets Manager at mesh/prod/{key}.