Supplying Proxy Credentials Outside Python Source

Reading a proxy URL from configuration keeps its password out of the source file. That is useful when the file is shared or versioned. It does not make the credential invisible to the process using it.

An environment variable, an interactive prompt, and a managed secret store provide different ways to deliver the value. Choose one that fits how the script runs. A scheduled service cannot answer a prompt, while a manually run utility may not need a persistent password file.

Keep the secret out of routine diagnostics after loading it. Printing a full proxies dictionary can undo the benefit of removing the password from the script. Log a safe account or endpoint identifier instead.

If the person running the code controls the process, encrypting a bundled password while also bundling everything needed to decrypt it does not create a reliable boundary against that person. The account's permissions and credential lifecycle need to match that reality.

Separate the goal into two questions: where the credential is stored, and who is allowed to use the proxy account. A configuration change can address the first without automatically changing the second.