branta 3.2.0__tar.gz

branta-3.2.0/.github/workflows/tests.yml

@@ -0,0 +1,39 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run tests with coverage
+        run: |
+          coverage run -m pytest tests/ --ignore=tests/test_integration.py -v
+          coverage report
+          coverage xml
+        env:
+          BRANTA_SKIP_INTEGRATION: "1"
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-${{ matrix.python-version }}
+          path: coverage.xml

branta-3.2.0/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.Python
+.venv/
+venv/
+dist/
+build/
+*.egg-info/
+.eggs/
+.pytest_cache/
+.coverage
+coverage.xml
+htmlcov/
+.mypy_cache/
+*.egg

branta-3.2.0/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [3.2.0] - 2026-06-26
+
+### Added
+- `PaymentBuilder.set_child_platform(name, logo_url, logo_light_url)` — allows master-switch platforms to associate a child platform with a payment on POST
+- `Payment.child_platform` field (optional `Platform`) to hold the child platform data before submission
+- Removed tracked `__pycache__` files and ensured they are covered by `.gitignore`
+
+## [3.1.0] - 2026-06-25
+
+### Added
+- Initial release of the Branta Python SDK
+- Feature-parity port of `branta-js` 3.1.4 and `branta-dotnet` 3.1.6
+- `BrantaService` with `get_payments`, `get_payments_by_qr_code`, `add_payment`, and `is_api_key_valid`
+- `PaymentBuilder` fluent builder for constructing `Payment` objects
+- `QRParser` for parsing Bitcoin and Lightning URI QR codes
+- AES-256-GCM encryption with deterministic and random nonce modes
+- Zero-knowledge (ZK) destination support for Bitcoin addresses, BOLT-11, Ark, and silent payments
+- Metadata DEK-envelope encryption
+- `PrivacyMode.Strict` (default) and `PrivacyMode.Loose` enforcement
+- HMAC-SHA256 signing support for parent platform use
+- Full type annotations and async/await throughout
+- Unit and integration tests with full branch coverage

branta-3.2.0/CLAUDE.md

@@ -0,0 +1,49 @@
+# Branta Python SDK
+
+Feature-parity Python port of the Branta SDK. Mirrors `branta-js` and `branta-dotnet` — any public API change in one must be reflected here and in the other two.
+
+## Package layout
+
+- `branta/` — top-level package; re-exports all public symbols
+- `branta/enums.py` — `BrantaServerBaseUrl`, `DestinationType`, `PrivacyMode`
+- `branta/exceptions.py` — `BrantaPaymentException`, `QRParseException`
+- `branta/models.py` — `Payment`, `Destination`, `Platform`, `PaymentsResult`, `AddPaymentResult`
+- `branta/options.py` — `BrantaClientOptions`
+- `branta/extensions.py` — shared helper functions (hash, fragment, type detection)
+- `branta/v2/service.py` — `BrantaService` (orchestrates ZK encrypt/decrypt around HTTP)
+- `branta/v2/client.py` — `BrantaClient` (raw HTTP; do not call directly from consumer code)
+- `branta/v2/builder.py` — `PaymentBuilder`
+- `branta/v2/parser.py` — `QRParser`
+- `branta/v2/encryption.py` — `AesEncryption` (static), `AesEncryptionService` (instance wrapper)
+- `branta/v2/secret_generator.py` — `GuidSecretGenerator`
+- `branta/v2/serialization.py` — snake_case JSON serialization helpers
+- `tests/` — mirrors `branta/`; unit tests use mocked client + AES; integration tests hit live endpoints
+
+## Setup
+
+```bash
+pip install -e ".[dev]"
+```
+
+## Commands
+
+- `pytest tests/ --ignore=tests/test_integration.py` — run unit tests (no network)
+- `pytest tests/test_integration.py` — run integration tests (requires network)
+- `coverage run -m pytest tests/ --ignore=tests/test_integration.py && coverage report` — with coverage
+- `pip install -e .` / `pip publish` — publish to PyPI (requires `twine`)
+
+## Key behaviors to preserve
+
+- **`PrivacyMode.Strict` is the default.** `get_payments` throws `BrantaPaymentException` for plain bitcoin addresses; `get_payments_by_qr_code` returns an empty `PaymentsResult`. `add_payment` throws if any destination has `is_zk=False`.
+- **`verify_url` is always returned**, even on a miss. Format: `{base_url}/v2/verify/{lookup}` plus `#k-{zk_id}={key}` fragments.
+- **ZK encryption:** Bitcoin addresses use a random secret (GUID); hash-ZK types (bolt11, ark, silent_payment) use a deterministic key from SHA256(normalized value). `add_payment` mutates `payment.destinations[*].value` to the encrypted form before POSTing.
+- **Metadata DEK-envelope:** If a payment has metadata and any ZK destination, a separate DEK is generated, metadata is encrypted with it, and the DEK is encrypted per-destination.
+- **Never surface lookup failures.** Swallow decryption errors; leave `is_encrypted=True` and value unchanged.
+- **Domain validation.** `platform_logo_url` must match `base_url` domain.
+
+## Conventions
+
+- Async throughout — `BrantaService` and `BrantaClient` methods are all `async def`.
+- Python snake_case for all public attribute and method names.
+- Inject `client`, `aes_encryption`, `secret_generator` into `BrantaService` for testing.
+- Keep feature-parity with `branta-js` and `branta-dotnet`: any new method, option, or enum value added here must be reflected in both.

branta-3.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Branta Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

branta-3.2.0/PKG-INFO

@@ -0,0 +1,152 @@
+Metadata-Version: 2.4
+Name: branta
+Version: 3.2.0
+Summary: Python SDK for the Branta V2 API — payment destination lookup and registration with zero-knowledge encryption support
+Project-URL: Homepage, https://branta.pro
+Project-URL: Repository, https://github.com/BrantaOps/branta-python
+Project-URL: Changelog, https://github.com/BrantaOps/branta-python/blob/main/CHANGELOG.md
+License: MIT
+License-File: LICENSE
+Keywords: bitcoin,branta,crypto,lightning,payments
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.9
+Requires-Dist: aiohttp>=3.9.0
+Requires-Dist: cryptography>=42.0.0
+Provides-Extra: dev
+Requires-Dist: coverage>=7.0.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
+Requires-Dist: pytest>=8.0.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# Branta Python SDK
+
+Python SDK for the [Branta](https://branta.pro) V2 API — payment destination lookup and registration with zero-knowledge encryption support.
+
+## Installation
+
+```bash
+pip install branta
+```
+
+## Integration Guide
+
+### Quick start
+
+```python
+import asyncio
+from branta.enums import BrantaServerBaseUrl, PrivacyMode
+from branta.options import BrantaClientOptions
+from branta.v2 import BrantaService
+
+options = BrantaClientOptions(
+    base_url=BrantaServerBaseUrl.Production,
+    privacy=PrivacyMode.Strict,
+)
+service = BrantaService(options)
+
+async def main():
+    result = await service.get_payments_by_qr_code("bitcoin:bc1q...")
+    if result.payments:
+        print(result.payments[0].get_default_value())
+
+asyncio.run(main())
+```
+
+### Privacy modes
+
+| Mode | Behaviour |
+|------|-----------|
+| `PrivacyMode.Strict` (default) | Only ZK lookups. `get_payments()` raises `BrantaPaymentException` for plain addresses. `get_payments_by_qr_code()` returns empty for plain addresses. `add_payment()` raises if any destination has `is_zk=False`. |
+| `PrivacyMode.Loose` | Both plain and ZK lookups are permitted. |
+
+### Looking up a payment by QR code
+
+```python
+result = await service.get_payments_by_qr_code(qr_text)
+# result.payments — list of Payment objects (empty if not found)
+# result.verify_url — always populated; share with the payer to verify
+```
+
+Prefer `get_payments_by_qr_code` for QR-driven flows. It handles multi-destination payloads (`branta_id` / `branta_secret` fragments) automatically.
+
+### Looking up a payment by destination value
+
+```python
+# Plain bitcoin address (requires PrivacyMode.Loose or will raise):
+result = await service.get_payments("bc1q...")
+
+# ZK-encrypted bitcoin address with secret:
+result = await service.get_payments(encrypted_address, destination_encryption_key="my-secret")
+
+# BOLT-11 invoice (hash-ZK — works in strict mode):
+result = await service.get_payments("lnbc...")
+```
+
+### Registering a payment
+
+```python
+from branta.enums import DestinationType
+
+builder = service.create_payment_builder()
+payment = (
+    builder
+    .add_destination("bc1q...", DestinationType.BitcoinAddress).set_zk()
+    .add_destination("lnbc...", DestinationType.Bolt11).set_zk()
+    .set_description("Donation")
+    .add_metadata("email", "donor@example.com")
+    .build()
+)
+
+result = await service.add_payment(payment, BrantaClientOptions(
+    base_url=BrantaServerBaseUrl.Production,
+    default_api_key="your-api-key",
+    privacy=PrivacyMode.Strict,
+))
+# result.payment — the registered payment from the server
+# result.secret — the random encryption key for the bitcoin address
+# result.verify_url — share this URL to verify the payment
+```
+
+### Validating an API key
+
+```python
+is_valid = await service.is_api_key_valid(BrantaClientOptions(
+    base_url=BrantaServerBaseUrl.Production,
+    default_api_key="your-api-key",
+))
+```
+
+### Per-call option overrides
+
+Every public method accepts an optional `BrantaClientOptions` parameter that overrides the service's default options for that call only:
+
+```python
+service = BrantaService(default_options)
+result = await service.get_payments("lnbc...", options=override_options)
+```
+
+## ZK destination types
+
+| Type | Encryption |
+|------|-----------|
+| `BitcoinAddress` | Random secret (GUID) per payment |
+| `Bolt11` | Deterministic: SHA256 of lowercase invoice |
+| `ArkAddress` | Deterministic: SHA256 of lowercase address |
+| `SilentPayment` | Deterministic: SHA256 of lowercase address |
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest tests/ --ignore=tests/test_integration.py     # unit tests
+pytest tests/test_integration.py                     # integration (requires network)
+coverage run -m pytest tests/ --ignore=tests/test_integration.py && coverage report
+```

branta-3.2.0/README.md

@@ -0,0 +1,124 @@
+# Branta Python SDK
+
+Python SDK for the [Branta](https://branta.pro) V2 API — payment destination lookup and registration with zero-knowledge encryption support.
+
+## Installation
+
+```bash
+pip install branta
+```
+
+## Integration Guide
+
+### Quick start
+
+```python
+import asyncio
+from branta.enums import BrantaServerBaseUrl, PrivacyMode
+from branta.options import BrantaClientOptions
+from branta.v2 import BrantaService
+
+options = BrantaClientOptions(
+    base_url=BrantaServerBaseUrl.Production,
+    privacy=PrivacyMode.Strict,
+)
+service = BrantaService(options)
+
+async def main():
+    result = await service.get_payments_by_qr_code("bitcoin:bc1q...")
+    if result.payments:
+        print(result.payments[0].get_default_value())
+
+asyncio.run(main())
+```
+
+### Privacy modes
+
+| Mode | Behaviour |
+|------|-----------|
+| `PrivacyMode.Strict` (default) | Only ZK lookups. `get_payments()` raises `BrantaPaymentException` for plain addresses. `get_payments_by_qr_code()` returns empty for plain addresses. `add_payment()` raises if any destination has `is_zk=False`. |
+| `PrivacyMode.Loose` | Both plain and ZK lookups are permitted. |
+
+### Looking up a payment by QR code
+
+```python
+result = await service.get_payments_by_qr_code(qr_text)
+# result.payments — list of Payment objects (empty if not found)
+# result.verify_url — always populated; share with the payer to verify
+```
+
+Prefer `get_payments_by_qr_code` for QR-driven flows. It handles multi-destination payloads (`branta_id` / `branta_secret` fragments) automatically.
+
+### Looking up a payment by destination value
+
+```python
+# Plain bitcoin address (requires PrivacyMode.Loose or will raise):
+result = await service.get_payments("bc1q...")
+
+# ZK-encrypted bitcoin address with secret:
+result = await service.get_payments(encrypted_address, destination_encryption_key="my-secret")
+
+# BOLT-11 invoice (hash-ZK — works in strict mode):
+result = await service.get_payments("lnbc...")
+```
+
+### Registering a payment
+
+```python
+from branta.enums import DestinationType
+
+builder = service.create_payment_builder()
+payment = (
+    builder
+    .add_destination("bc1q...", DestinationType.BitcoinAddress).set_zk()
+    .add_destination("lnbc...", DestinationType.Bolt11).set_zk()
+    .set_description("Donation")
+    .add_metadata("email", "donor@example.com")
+    .build()
+)
+
+result = await service.add_payment(payment, BrantaClientOptions(
+    base_url=BrantaServerBaseUrl.Production,
+    default_api_key="your-api-key",
+    privacy=PrivacyMode.Strict,
+))
+# result.payment — the registered payment from the server
+# result.secret — the random encryption key for the bitcoin address
+# result.verify_url — share this URL to verify the payment
+```
+
+### Validating an API key
+
+```python
+is_valid = await service.is_api_key_valid(BrantaClientOptions(
+    base_url=BrantaServerBaseUrl.Production,
+    default_api_key="your-api-key",
+))
+```
+
+### Per-call option overrides
+
+Every public method accepts an optional `BrantaClientOptions` parameter that overrides the service's default options for that call only:
+
+```python
+service = BrantaService(default_options)
+result = await service.get_payments("lnbc...", options=override_options)
+```
+
+## ZK destination types
+
+| Type | Encryption |
+|------|-----------|
+| `BitcoinAddress` | Random secret (GUID) per payment |
+| `Bolt11` | Deterministic: SHA256 of lowercase invoice |
+| `ArkAddress` | Deterministic: SHA256 of lowercase address |
+| `SilentPayment` | Deterministic: SHA256 of lowercase address |
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest tests/ --ignore=tests/test_integration.py     # unit tests
+pytest tests/test_integration.py                     # integration (requires network)
+coverage run -m pytest tests/ --ignore=tests/test_integration.py && coverage report
+```

branta-3.2.0/branta/__init__.py

@@ -0,0 +1,45 @@
+from branta.enums import BrantaServerBaseUrl, DestinationType, PrivacyMode
+from branta.exceptions import BrantaPaymentException, QRParseException
+from branta.extensions import (
+    get_api_key,
+    get_base_url,
+    get_hash_zk_type,
+    get_hmac_secret,
+    get_privacy,
+    get_url,
+    is_ark,
+    is_bolt11,
+    is_silent_payment,
+    to_normalized_hash,
+    to_url_fragment,
+)
+from branta.models import AddPaymentResult, Destination, Payment, PaymentsResult, Platform
+from branta.options import BrantaClientOptions
+from branta.v2.encryption import AesEncryption, AesEncryptionService
+
+__all__ = [
+    "BrantaServerBaseUrl",
+    "DestinationType",
+    "PrivacyMode",
+    "BrantaPaymentException",
+    "QRParseException",
+    "BrantaClientOptions",
+    "Payment",
+    "Destination",
+    "Platform",
+    "PaymentsResult",
+    "AddPaymentResult",
+    "AesEncryption",
+    "AesEncryptionService",
+    "get_url",
+    "get_base_url",
+    "get_privacy",
+    "get_api_key",
+    "get_hmac_secret",
+    "get_hash_zk_type",
+    "is_bolt11",
+    "is_ark",
+    "is_silent_payment",
+    "to_normalized_hash",
+    "to_url_fragment",
+]

branta-3.2.0/branta/enums.py

@@ -0,0 +1,23 @@
+from enum import Enum
+
+
+class BrantaServerBaseUrl(str, Enum):
+    Staging = "https://staging.guardrail.branta.pro"
+    Production = "https://guardrail.branta.pro"
+    Localhost = "http://localhost:3000"
+
+
+class PrivacyMode(str, Enum):
+    Strict = "strict"
+    Loose = "loose"
+
+
+class DestinationType(str, Enum):
+    BitcoinAddress = "bitcoin_address"
+    Bolt11 = "bolt11"
+    Bolt12 = "bolt12"
+    LnUrl = "ln_url"
+    TetherAddress = "tether_address"
+    LnAddress = "ln_address"
+    ArkAddress = "ark_address"
+    SilentPayment = "silent_payment"

branta-3.2.0/branta/exceptions.py

@@ -0,0 +1,6 @@
+class BrantaPaymentException(Exception):
+    pass
+
+
+class QRParseException(Exception):
+    pass

branta-3.2.0/branta/extensions.py

@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+import hashlib
+from typing import TYPE_CHECKING, Dict, Optional
+
+from branta.enums import DestinationType, PrivacyMode
+
+if TYPE_CHECKING:
+    from branta.options import BrantaClientOptions
+
+
+def get_url(server: BrantaServerBaseUrl) -> str:
+    return server.value
+
+
+def get_base_url(
+    default_options: Optional[BrantaClientOptions],
+    override_options: Optional[BrantaClientOptions],
+) -> str:
+    base_url = None
+    if override_options is not None and override_options.base_url is not None:
+        base_url = override_options.base_url
+    elif default_options is not None and default_options.base_url is not None:
+        base_url = default_options.base_url
+    if base_url is None:
+        raise ValueError("Branta: base_url is a required option.")
+    return get_url(base_url)
+
+
+def get_privacy(
+    default_options: Optional[BrantaClientOptions],
+    override_options: Optional[BrantaClientOptions],
+    fallback: PrivacyMode = PrivacyMode.Strict,
+) -> PrivacyMode:
+    if override_options is not None and override_options.privacy is not None:
+        return override_options.privacy
+    if default_options is not None and default_options.privacy is not None:
+        return default_options.privacy
+    return fallback
+
+
+def get_api_key(
+    default_options: Optional[BrantaClientOptions],
+    override_options: Optional[BrantaClientOptions],
+) -> Optional[str]:
+    if override_options is not None and override_options.default_api_key is not None:
+        return override_options.default_api_key
+    if default_options is not None and default_options.default_api_key is not None:
+        return default_options.default_api_key
+    return None
+
+
+def get_hmac_secret(
+    default_options: Optional[BrantaClientOptions],
+    override_options: Optional[BrantaClientOptions],
+) -> Optional[str]:
+    if override_options is not None and override_options.hmac_secret is not None:
+        return override_options.hmac_secret
+    if default_options is not None and default_options.hmac_secret is not None:
+        return default_options.hmac_secret
+    return None
+
+
+def is_bolt11(value: str) -> bool:
+    lower = value.lower()
+    return lower.startswith("lnbc") or lower.startswith("lntb") or lower.startswith("lnbcrt")
+
+
+def is_ark(value: str) -> bool:
+    return value.lower().startswith("ark1")
+
+
+def is_silent_payment(value: str) -> bool:
+    lower = value.lower()
+    return lower.startswith("sp1") or lower.startswith("tsp1")
+
+
+def get_hash_zk_type(value: str) -> Optional[DestinationType]:
+    if is_bolt11(value):
+        return DestinationType.Bolt11
+    if is_ark(value):
+        return DestinationType.ArkAddress
+    if is_silent_payment(value):
+        return DestinationType.SilentPayment
+    return None
+
+
+def to_normalized_hash(value: str) -> str:
+    normalized = value.lower()
+    return hashlib.sha256(normalized.encode("utf-8")).hexdigest().upper()
+
+
+def to_url_fragment(keys: Dict[str, str]) -> str:
+    if not keys:
+        return ""
+    fragments = [f"k-{k}={v}" for k, v in keys.items()]
+    return "#" + "&".join(fragments)

branta-3.2.0/branta/models.py

@@ -0,0 +1,58 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import List, Optional
+
+from branta.enums import DestinationType
+
+
+@dataclass
+class Destination:
+    value: str
+    is_primary: bool = False
+    is_zk: bool = False
+    is_encrypted: Optional[bool] = None
+    type: Optional[DestinationType] = None
+    zk_id: Optional[str] = None
+    encrypted_dek: Optional[str] = None
+
+
+@dataclass
+class Platform:
+    name: Optional[str] = None
+    logo_url: Optional[str] = None
+    logo_light_url: Optional[str] = None
+
+
+@dataclass
+class Payment:
+    destinations: List[Destination] = field(default_factory=list)
+    description: Optional[str] = None
+    created_date: Optional[str] = None
+    ttl: Optional[int] = None
+    metadata: Optional[str] = None
+    platform: Optional[str] = None
+    platform_logo_url: Optional[str] = None
+    platform_logo_light_url: Optional[str] = None
+    parent_platform: Optional[Platform] = None
+    child_platform: Optional[Platform] = None
+    btc_pay_server_plugin_version: Optional[str] = None
+    is_metadata_decrypted: Optional[bool] = None
+
+    def get_default_value(self) -> str:
+        if not self.destinations:
+            raise ValueError("Payment has no destinations")
+        return self.destinations[0].value
+
+
+@dataclass
+class PaymentsResult:
+    payments: List[Payment]
+    verify_url: str
+
+
+@dataclass
+class AddPaymentResult:
+    payment: Payment
+    secret: str
+    verify_url: str

branta-3.2.0/branta/options.py

@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Optional
+
+from branta.enums import BrantaServerBaseUrl, PrivacyMode
+
+
+@dataclass
+class BrantaClientOptions:
+    base_url: BrantaServerBaseUrl
+    privacy: Optional[PrivacyMode] = None
+    default_api_key: Optional[str] = None
+    hmac_secret: Optional[str] = None