Let your agent ask for a key

Your coding agent needs an environment variable. You approve once with a passkey, and your browser sends the value straight to Vercel, GitHub or Netlify.

A coding agent often stops with "create a key at Resend and add it to Vercel as RESEND_API_KEY". A secret request turns that into one link. You open it, pick or paste the value, choose where it goes and approve with your passkey. Your browser saves the value in your vault and sends it to the deploy target. The agent is told how it went and carries on. It never receives the value.

#Before you start

• Your agent is connected to StackHangar and allowed to ask about the project. See Connect an agent.
• You can unlock your vault in the browser where you'll open the link. See Unlock your vault.
• To have the value sent for you, the project needs a deploy target and a token for it. See Deploy targets. Without one, the value is still saved in your vault and you add it to the service by hand.

#Ask your agent

Tell your agent what you need in plain words. For example:

We need a Resend API key in Vercel as RESEND_API_KEY for production and preview.
Use StackHangar to ask me for it.

The agent calls request_secret and shows you a link that starts with https://app.stackhangar.com/approve/deliver. Open it within 10 minutes. Once it's open you have 30 minutes to answer, which leaves time to create the key at the provider. The agent can keep working while it waits.

#Approve the request

The page is titled Agent secret request. At the top it shows the Agent, the Project, the Variable name and the Time left, with the agent's own reason after Agent says:.

1. Under 1. The value, choose one:
   • Use an item already in this project, then pick it under Which item?
   • Add a new item, then paste the value. It is encrypted in this browser before it's saved. If your agent named the service, it is already selected, with a link to the provider's own page for creating the key.
2. Under 2. Where it goes, tick Send NAME here for each deploy target you want, and choose the Environments. What your agent asked for is marked Asked for. Tick Redeploy after sending if the new value should go live straight away.
3. Press Review. The Confirm screen lists exactly what will happen: which item is saved or used, each deploy target and its environments, and any redeploy.
4. Press Confirm with passkey. One passkey check approves all of it.

Your browser then saves the value, tells StackHangar the request is approved, and sends the value to each deploy target. Keep the tab open until the page shows the result.

If you leave every deploy target unticked, the value is only saved in your vault and nothing is sent.

#Save the value with the browser extension

If you use the browser extension, you can capture the new key on the provider's page instead of pasting it. The approval page picks it up and shows Picked up the value you saved with the browser extension.

#What you see afterwards

Your agent sees the same result for each service it asked about, plus a reference to the item. For By hand it is told you may not have finished, so it should ask you before relying on the variable.

#Checks the page makes for you

• Names that are public. A name starting with NEXT_PUBLIC_, VITE_, PUBLIC_, REACT_APP_, EXPO_PUBLIC_, NUXT_PUBLIC_ or a similar framework prefix ends up in the code sent to every visitor. The page warns you and asks you to tick This value is meant to be public before it continues.
• A variable another item already sends. If another item in your vault already sends this variable to the same deploy target, the page says which one. Tick Replace it to make the new item the only sender, or untick the deploy target. Replacing is only offered when your choice covers every environment the other item sends to.
• Production. If the request includes a Production value, the Confirm screen says so. The same passkey check covers it.
• Tokens. The item that holds the token StackHangar uses to reach a deploy target can't itself be picked as the value.
• GitHub names. GitHub doesn't allow names that start with GITHUB_.
• Changes in another tab. If your vault changes or locks while you're confirming, nothing is saved over and nothing is sent. Review and confirm again.

#What the agent can and can't see

The agent never gets the value, the item's name, your project names, or which Vercel project, GitHub repository or Netlify site you picked.

The value doesn't pass through StackHangar's servers in the clear either. Your browser encrypts it for your vault and sends it directly to the service you chose. See What we can and can't see.

#Limits

• The link must be opened within 10 minutes. Once opened, you have 30 minutes, in the same browser session that opened it.
• One request is for one variable. It can go to one Vercel project, one GitHub repository and one Netlify site.
• An agent can have 5 requests waiting at a time and make 30 in an hour.
• It doesn't put the value on your own computer. For local development, add the variable to your local environment yourself.
• It doesn't create the key at the provider. You create it; the page links you to the right place when the service is in the catalog.

#If something goes wrong

For the full tool reference, see Agent tools.

Something missing or wrong on this page? Tell us.