/
Menu

Approve a request

What the approval page shows, how the 10-minute link works, and the difference between an entry request and an access request.

This page helps you answer a request from an agent: add a key, or use one.

#Before you start

#Steps

  1. Your agent shows you an approval link. It works for 10 minutes and can be used once.
  2. Open it. The Agent request page shows:
    • Agent, with when it connected and how many requests it has made so far.
    • Wants to, either "Add a credential (you type it in)" or "Use a credential (you see it, the agent doesn't)".
    • Project.
    • Agent says, the agent's own description, as plain text.
    • Expires, a countdown.
  3. Read the warning. Only approve if you just asked your agent for this. If you didn't, choose Deny or let the link expire.
  4. Complete the request as described below, then do the passkey check.

If you didn't ask an agent for anything, ignore a link that reaches you.

#Entry requests: the agent wants you to add a key

You fill in the form on the page:

  • Name, how it appears in your vault.
  • Provider and Environment.
  • Value. It is encrypted in your browser before it is saved. StackHangar and the agent never see it.
  • Rotation reminder: every 90 days, every 180 days, every year, or no reminder.

Choose Save and approve. The passkey check comes first, then the item is saved, then the agent is told. The agent receives only a reference to the new item.

#Access requests: the agent wants to use a key

The page lists the stored keys in that project. Pick one under Which credential? and choose Approve and show it to me.

After the passkey check, the value is shown on the page for 30 seconds, with Copy and Hide now buttons. You use it yourself, for example in your .env. The agent is told only that you approved, with a reference to the item.

Warning

Never paste the value into your agent's chat. Once the agent can read it, StackHangar can't take it back.

If the project has no stored keys yet, the page says so and you can only deny.

#Deny

Deny needs no passkey check. The agent is told the request was denied and nothing is shared.

#What happens next

The agent checks the request and sees one of: pending, approved, denied or expired. On approval it gets an item reference. Your answer is recorded in Settings, under Activity.

#If something goes wrong

  • "This approval link is incomplete." The link was cut off. Ask the agent for a new one.
  • "This link has expired." The 10 minutes passed. Ask the agent to make a new request.
  • "This link was already used." A link works once.
  • The link isn't valid for your account. You are signed in to a different account than the one the agent is connected to.
  • "The agent that made this request was disconnected." Connect it again.
  • "Not one of your projects." The request points at a project that isn't in your vault. You can only deny it.
  • The passkey prompt was closed. Nothing was shared. Choose the approve button again.
  • The agent says it made too many requests. An agent can have 5 requests waiting and make 30 an hour.

For a request to put a key into an environment variable at Vercel, GitHub or Netlify, see Secret requests.