Settings and secrets

Settings and secret types are catalog declarations. A function’s requirement only asks for a value that the worker has already declared.

Settings

Copy Copied!

worker.RegisterSetting(
  "multiplier",
  "Value multiplier",
  Int64Type.Default,
  new Int64Array.Builder().Append(1).Build());

In a ScalarFn, inject it with [Setting(Key = "multiplier")] long multiplier. Other function interfaces declare RequiredSettings and decode the bind-time settings carried in their params.

Secrets

Register a secret type with an Arrow parameter schema. Put "redact": "true" in sensitive field metadata so DuckDB masks it in catalog inspection.

Copy Copied!

worker.RegisterSecretType(
  "demo_api",
  "Credentials for the demo service",
  new Schema([
      new Field("api_key", StringType.Default, true,
          new Dictionary<string, string> { ["redact"] = "true" }),
  ], metadata: null));

Scalar reflection supports [Secret]; the raw interfaces declare RequiredSecrets. Secret values arrive already resolved for the call’s scope. Do not log their payloads or persist them outside the query unless your security model explicitly requires it.