Integrations

Environment secrets

The settings and secrets your code needs to compile, run, and test - end-to-end encrypted, shared only with the agents you create.

Real projects don’t run on a fresh clone alone: they need a DATABASE_URL, a test-account API key, a license token. The Environment page holds those values for your organization, and every one of them is end-to-end encrypted in your browser before they’re sent to Agent Chatham.

What goes here

Anything your code needs as an environment variable to compile, run, or pass its tests inside an agent’s sandbox. This tab is for project secrets - model provider credentials live on the Models page instead (same encryption, different job).

Adding secrets

Click Add Secret to open the bulk editor: up to ten key/value rows at a time, with values masked as you type. Fill in as many as you need - empty rows are ignored. Each value is sealed in your browser for your approved devices before anything is sent; the server only ever stores ciphertext.

Secrets are scoped to the organization, listed alphabetically, searchable, and support bulk delete. Deleting a secret removes it from every device it was ever shared to.

How secrets reach an agent

When you create a managed agent, the provisioning wizard has a “Sharing secrets with the agent…” step: your browser decrypts your secrets locally and re-encrypts each one for the new agent’s own device key. The server relays sealed values it cannot read; the agent decrypts them inside its sandbox and exports them as environment variables.

Access is re-checked continuously - an agent (or any device) that’s revoked stops receiving secrets immediately.

Good practice

• Use per-environment values (a staging database, a sandboxed payment key) - agents rarely need production credentials to do their work.
• Prefer scoped, revocable tokens where your services offer them; if an agent is terminated, rotating one token beats rotating your account password.
• Remember that secret names are visible to the server (values never are) - don’t put sensitive information in the key itself.