Inject API keys and credentials into a Modal Function with modal.Secret

Documented steps

1. Create the secret once, in the dashboard or with the CLI, then reference it by name: `@app.function(secrets=[modal.Secret.from_name("openai-keys")])`.
2. Read values inside the container from the process environment: `os.environ["OPENAI_API_KEY"]`. Secrets are injected as environment variables only — there is no Python object exposing the values.
3. Fail fast on misconfiguration by declaring what you need: `modal.Secret.from_name("openai-keys", required_keys=["OPENAI_API_KEY"])` errors at deploy time instead of KeyError at runtime.
4. For values already in your local shell, use `modal.Secret.from_local_environ(["HF_TOKEN"])`; for a local dotenv file use `modal.Secret.from_dotenv()` (defaults to filename ".env").
5. For literals in code (test fixtures only, never real credentials committed to a repo) use `modal.Secret.from_dict({"MODE": "test"})`.
6. Attach secrets to classes the same way: `@app.cls(secrets=[...])`, and to build steps via `Image.run_function(fn, secrets=[...])` when the build itself needs a token.
7. Branch on execution location with `modal.is_local()` when the local and remote credential sources differ.
8. Manage programmatically via `modal.Secret.objects.create(name, env_dict, allow_existing=False)`, `.list()`, and `.delete(name, allow_missing=False)`.
9. Reference: https://modal.com/docs/guide/secrets