We can pass in secrets to ourrunnables at runtime using theRunnableConfig. Specifically we can pass in secrets with a__ prefix to theconfigurable field. This will ensure that these secrets aren't traced as part of the invocation:

from langchain_core.runnablesimport RunnableConfig
from langchain_core.toolsimport tool


@tool
deffoo(x:int, config: RunnableConfig)->int:
"""Sum x and a secret int"""
return x+ config["configurable"]["__top_secret_int"]


foo.invoke({"x":5},{"configurable":{"__top_secret_int":2,"traced_key":"bar"}})

7

Looking at the LangSmith trace for this run, we can see that "traced_key" was recorded (as part of Metadata) while our secret int was not:https://smith.langchain.com/public/aa7e3289-49ca-422d-a408-f6b927210170/r