Secrets · NoMac

Secrets

API keys, tokens and files that every Mac of the account receives. A person enters each one once, and the agent's chat never sees it.

Add a secret

In the browser: nomac.app/dash/secrets.

In a terminal: nomac secrets set NAME, or every line of a file with --from-env-file .env.

Through a link: Your agent calls request_secret and gives you a link. Whoever holds the value (you, a teammate, a client) enters it once within 24 hours, with no NoMac account.

Terminal

nomac secrets set ANTHROPIC_API_KEY
nomac secrets set --from-env-file .env

An agent never asks for a secret in the chat. Values are encrypted, and no API returns them.

On the Mac

Variables are in the environment of every command, SSH session and login shell.
Files go to their path: ~/.nomac/secrets/NAME unless you choose another.
Values are masked in command output.
Every new Mac receives them, and one added, changed or deleted while a Mac runs reaches it within a minute, with no call. A secret marked on request is installed only when named: install_secrets (nomac secrets install NAME).

Apple keys stay on NoMac

The App Store Connect key you add at nomac.app/dash/apple is not a secret on the Mac. It stays on NoMac's server, where the signing and TestFlight tools use it. Store the .p8 as a secret file only if your own tools, such as fastlane or Transporter, need it; then every Mac has it.