---
name: Secrets
slug: secrets
category: DevOps
description: Secrets secures API keys, access tokens, passwords, webhook secrets, and other credentials by requesting them from the user and writing them to a dotenv file without exposing values to the agent. Use it when configuring an application or deployment environment that requires secrets.
github: "https://github.com/get-bb/bb/tree/main/plugins/secrets/skills/secrets"
language: TypeScript
stars: 2274
forks: 253
install: "npx degit https://github.com/get-bb/bb/tree/main/plugins/secrets/skills/secrets ~/.claude/skills/secrets"
installs_to: ~/.claude/skills/secrets
source_path: plugins/secrets/skills/secrets/SKILL.md
collection_size: 14
category_size: 798
collection_url: "https://dirskills.com/collections/get-bb/bb"
added: 2026-08-18T06:58:21.676Z
last_synced: 2026-08-18T06:58:21.676Z
canonical_url: "https://dirskills.com/skills/secrets"
---

# Secrets

Secrets secures API keys, access tokens, passwords, webhook secrets, and other credentials by requesting them from the user and writing them to a dotenv file without exposing values to the agent. Use it when configuring an application or deployment environment that requires secrets.

**Install:**

```bash
npx degit https://github.com/get-bb/bb/tree/main/plugins/secrets/skills/secrets ~/.claude/skills/secrets
```

## README

# Request secrets securely

Use `bb secret request` whenever work needs a credential. Do not ask the user to paste a secret into chat.

Batch every currently known variable into one request. Inspect documentation or `.env.example` to identify variable names, but do not read or print an existing secret-bearing env file.

```bash
bb secret request OPENAI_API_KEY RESEND_API_KEY \
  --purpose "Configure application credentials" \
  --describe OPENAI_API_KEY "OpenAI API key used by the server" \
  --describe RESEND_API_KEY "Resend API key used for transactional email" \
  --write-env .env.local
```

Always provide the exact `--write-env` destination, a concise purpose, and one short plain-language description per variable. Relative destinations resolve from the CLI working directory; absolute destinations may point anywhere on the thread's host. Never place secret values in argv, prompts, comments, logs, or follow-up messages.

After success, trust the command's path and added/updated/unchanged counts. Never verify by running `cat`, `sed`, `env`, or another command that would reveal the completed file.

If the command reports duplicate dotenv assignments, fix the file structure without reading values and rerun the request. If it reports repeated write conflicts, rerun the same request; do not ask the user to paste values. Under the workspace sandbox (Accept Edits / Approve for me), Claude's macOS sandbox permits the loopback access plugin CLI commands need; Linux and other provider sandboxes may still require escalation approval.