Skip to content

Coding agents

How to give a coding agent an API key safely

Short answer

Put a restricted API key in an environment variable set outside the project, tell the coding agent the variable’s name, and let the commands it runs read the value. Do not paste the key into the prompt.

Use a separate key for agent work so you can revoke it without breaking anything else. When the key comes from a client or a colleague, have it sent as an Argoned sealed link, an encrypted link that opens once, rather than a chat message.

By Argoned Last reviewed

A coding agent running in a terminal window

The risk

Why pasting an API key into the prompt is risky

A key typed into a coding agent’s prompt can travel into transcripts, files, commits and other people’s hands.
Source code on a monitor
  • The prompt is part of the conversation, which the AI provider receives and your tool may keep as a transcript.
  • Coding agents write files, logs, test fixtures and commit messages. A key in the conversation can be copied into any of them.
  • Anything committed to git is hard to take back, even after you delete the line.
  • Agents read pages, issues and documents. Hidden instructions in that content, known as prompt injection, can try to make an agent use a key it knows somewhere else.

Compared

Where to keep an API key, compared

Four places an API key can sit while a coding agent works, riskiest first, and where a sealed link fits in.
Places to keep an API key when a coding agent needs it
ApproachExposureNotes
Pasted into the prompt In the transcript, and possibly in files the agent writes Avoid
.env file inside the project Plain text on disk, inside the folder the agent works in Keep it out of git and block the agent from reading it
Environment variable set outside the project Not in the repository; processes you start can read it A good default
Secret injection tool, such as Bitwarden’s aac run Injected into one process after you approve Bitwarden calls its Agent Access SDK an early preview
Argoned sealed link Used for the handover only Then store the key in an environment variable

Step by step

Step by step: give a coding agent an API key

Six steps from creating an agent-only key to revoking it, with an example of setting the key in your shell.
A person beside a locked safe

  1. Create a key just for agent work

    Use a test project, a read-only scope or a spending limit if the provider offers one. Name it so you know it is the agent key.

  2. Receive it sealed, if someone else creates it

    Ask the key owner to send it as a sealed link and to give you the access code by a different route. Open it in your browser.

  3. Set it as an environment variable

    Set it in your shell profile or your operating system’s secret store, not in a file inside the project.

  4. Give the agent the name, not the value

    Tell the agent “use the PAYMENTS_TEST_KEY environment variable”. It can run commands that read it without the key appearing in the prompt.

  5. Block secret files

    In Claude Code, add Read deny rules such as Read(./.env) to your settings. In Cursor, list secret files in .cursorignore. Both tools note that terminal commands can still read files, so do not auto-approve commands such as cat.

  6. Revoke it when the work is done

    Delete the agent key at the provider. If it was ever pasted into a prompt or committed, revoke it straight away.

Set the key in your shell, then refer to it by name
# Option 1: in your shell profile (such as ~/.zshrc), outside the project
export PAYMENTS_TEST_KEY="replace-with-your-test-key"

# Option 2: this terminal only, typed at a hidden prompt so it stays out of shell history
read -rs PAYMENTS_TEST_KEY && export PAYMENTS_TEST_KEY
# Then start the coding agent from this same terminal

# What you tell the agent, never the key itself
"Call the payments test API using the PAYMENTS_TEST_KEY environment variable."

Argoned

Where Argoned fits

Argoned handles the handover between people, not the agent itself, and that boundary is deliberate.
A phone sharing a link

Argoned does not plug into Claude Code, Cursor or Codex. Its job is the handover: getting a key from the person who owns it to the person who sets up the agent, without the key sitting in a chat, an email or a ticket.

A coding agent in a terminal usually cannot type an access code into a web page, and you should not give it the code in the prompt. Open the sealed link yourself and put the value in an environment variable.

FAQ

Questions

Short answers about .env files, keys already pasted into prompts, one key per project and coding agents with sealed links.
Two people beside a large question mark
Can Claude Code or Cursor read my .env file?

They can read files in the project unless you block them. Claude Code supports Read deny rules for files such as .env, and Cursor blocks files listed in .cursorignore from its agent. Terminal commands can still read blocked files, so review commands before you approve them.

I already pasted a key into a prompt. What now?

Revoke it at the provider and create a new one. Deleting the message does not un-send it.

Should each agent or project get its own key?

Yes. Separate keys let you see which one was used and revoke one without breaking the others.

Can a coding agent open an Argoned sealed link?

Not usefully. The link needs an access code typed into a web page. Open it yourself, then set the environment variable.

Next

More guides on handing logins and API keys to AI agents and people without pasting them in plain text.

Sources

A person beside a locked laptop

Your agent needs a login. Send it sealed.

Seal a login or API key in your browser and send a link instead of the password.

Create a free vault All AI agent guides

£0 · Free plan, no card needed · Encrypted in your browser