# Secrets

API keys, tokens and files that every Mac of the account receives. A person enters each one once, and the agent's chat never sees it.

## Add a secret

In the browser: [nomac.app/dash/secrets](/content/dash/secrets/index.html).

In a terminal: `nomac secrets set NAME`, or every line of a file with `--from-env-file .env`.

Through a link: Your agent calls `request_secret` and gives you a link. Whoever holds the value (you, a teammate, a client) enters it once within 24 hours, with no NoMac account.

Terminal

```
nomac secrets set ANTHROPIC_API_KEY
nomac secrets set --from-env-file .env
```

An agent never asks for a secret in the chat. Values are encrypted, and no API returns them.

## On the Mac

- Variables are in the environment of every command, SSH session and login shell.
- Files go to their path: `~/.nomac/secrets/NAME` unless you choose another.
- Values are masked in command output.
- Every new Mac receives them, and one added, changed or deleted while a Mac runs reaches it within a minute, with no call. A secret marked on request is installed only when named: `install_secrets` (`nomac secrets install NAME`).

## Apple keys stay on NoMac

The App Store Connect key you add at [nomac.app/dash/apple](/content/dash/apple/index.html) is not a secret on the Mac. It stays on NoMac's server, where the signing and TestFlight tools use it. Store the .p8 as a secret file only if your own tools, such as fastlane or Transporter, need it; then every Mac has it.