Secrets

Agents that run in your hosted workspace, the ones you start from the console, need their model provider’s key. Running your own agent in the workspace is in private beta; see Hosted workspace. You set the key from a shell where it is exported. It never goes through a form or a command argument.

export OPENAI_API_KEY=...        # already in your shell
ancha secrets set OPENAI_API_KEY # or ANTHROPIC_API_KEY, OPENROUTER_API_KEY
ancha secrets list

The value is stored on your workspace’s disk and given to attempts of agents that declare that provider when you connect them. Setting or removing a variable restarts the workspace’s processes; give it a few seconds.

Command	Does
`ancha secrets set NAME...`	Copies each named variable from your shell into the workspace.
`ancha secrets list`	Prints the names, never the values.
`ancha secrets unset NAME`	Removes one variable.

Names are upper snake case, up to 64 characters. You must be signed in with ancha login, or have ANCHA_SERVER_URL and ANCHA_API_KEY set. See ancha secrets.

Which runs use them

Run	Where the agent gets keys
Run tasks in the console	Workspace secrets, for agents that declare that provider.
`ancha run` on your computer, even when signed in	The names you list in `agent.pass_env` or `--pass-env`, taken from your own shell. Workspace secrets are not used.
`ancha run` in CI	The names you pass from the CI job’s environment. See CI.

Model calls are billed by your provider.

Get started

Guides

Concepts

Tools

CLI

Reference

Cloud

Help

Which runs use them

​Which runs use them

Which runs use them