SPACE

Appearance

Secrets and connections ​

SPACE provides centrally managed secrets and connections that Python scripts and notebooks can access through the SPACE Python SDK.

Use them instead of storing passwords, API keys, and environment-specific connection details directly in Python code, notebooks, configuration files, or Git repositories.

Secrets ​

A secret is a named collection of sensitive fields managed in SPACE.

For example, a secret could contain:

text
username
password

or:

text
api_key

Secret names and field names can be chosen to match the system or integration they represent.

Import the SPACE SDK resources and retrieve the secret by name:

python
from space import secrets

secret = secrets.get("Workday PROD")
username = secret["username"]

You can also access a field directly:

python
from space import secrets

username = secrets.get("Workday PROD")["username"]

The returned secret contains the fields configured for that secret in SPACE.

Do not print the returned object or its sensitive fields to notebook output or application logs.

Connections ​

Connections represent systems configured centrally in SPACE.

Python code can retrieve a configured connection using connections.get():

python
from space import connections

connection = connections.get("TeamOneTest")
print(connection)

The returned configuration can include information such as the connection URL, authentication type, and authentication fields required by the target system.

This allows Python integrations to reuse the same centrally managed connection configuration instead of maintaining a separate Python-specific configuration file.

Creating and managing SPACE connections is covered under Connections.

Secrets or connections? ​

Use a secret when the Python workflow needs a set of credentials or sensitive values that are not represented by a SPACE connection.

Use a connection when the external system is already configured as a SPACE connection and the Python code should reuse that configuration.

For example:

  • an API key for a custom external service can be stored as a secret;
  • an IBM Planning Analytics connection can be retrieved as a connection;
  • a username/password pair used only by a custom Python integration can be stored as a secret.

Using connection credentials with TM1py ​

A common use case is reusing a SPACE Planning Analytics connection from TM1py.

The workflow is:

  1. retrieve the Planning Analytics connection using connections.get();
  2. inspect its authentication type and returned connection fields;
  3. map the relevant values to TM1Service;
  4. use TM1py normally for the rest of the workflow.

For example, a username/password connection can conceptually be used as follows:

python
from space import connections
from TM1py.Services import TM1Service

config = connections.get("Planning Analytics - Production")

with TM1Service(
    base_url=config["base_url"],
    user=config["username"],
    password=config["password"],
    namespace=config["namespace"],
) as tm1:
    print(tm1.server.get_server_name())

The exact authentication fields depend on how the Planning Analytics connection is configured. See TM1py for complete examples and authentication-specific guidance.

Security considerations ​

Secrets are intended to keep sensitive values out of Python source code and source control.

When using them:

  • retrieve credentials only when needed;
  • do not print credentials or complete secret/connection objects;
  • do not write retrieved credentials to project files;
  • do not commit credentials to Git;
  • prefer centrally managed SPACE connections when an appropriate connection already exists.

The older space.cfg approach is no longer the recommended way to manage credentials for new Python workflows. Use SPACE-managed secrets or connections instead.