Documentation

ai.Credential

A client credential (or endpoint) option: either the literal value, or a LATE-BOUND `baml.env.Ref` naming the environment variable that holds it.

Reference version

Signature

type ai.Credential = string | baml.env.Ref

A client credential (or endpoint) option: either the literal value, or a LATE-BOUND baml.env.Ref naming the environment variable that holds it.

Every provider client's api_key / base_url is Credential?, so all three shapes are accepted positionally:

api_key = "sk-..."                  // literal
api_key = env.OPENAI_API_KEY        // late-bound ref, read per request
api_key = null                      // fall back to the canonical env var

A Ref carries the variable's NAME only, never its value: a constructed client never holds the secret, and the read happens at request time — after $init (which cannot do io) and after a host has loaded its secrets. ai.wire.resolve_credential collapses the union to string?.

Source:<builtin>/ai/spec.bamlbytes 1073–1113