From README to production: shipping your first Ranbval integration
Playbook · 8 min read · Published 2026-04-15 by Ahsan Tariq
A pragmatic walkthrough for replacing your plaintext OPENAI_API_KEY without blowing up the dev loop.
The hardest part of adopting a secrets product is usually the migration. Ranbval keeps it short. Step one: pip install ranbval-sdk. Step two: in the Ranbval dashboard, create a project named after your service and add a slot for each provider. Paste the current plaintext key once — it is sealed with your master password before it leaves the form. Step three: swap the import. Replace openai.api_key = os.environ["OPENAI_API_KEY"] with from ranbval.openai import OpenAI; client = OpenAI(project="retrieval-stack", slot="openai_prod"). Step four: bind the repo. Tell Ranbval which git remote is allowed to resolve this slot. Run it in CI once; the policy sticks. If a forked clone tries to use the key, the Ranbval SDK refuses and logs an access request. What you get for ten minutes of work: no plaintext key in .env, CI variables, or shell history, and a ready-made audit trail the next time your CTO asks where the keys live.
