---
name: secrets-manager-cli
description: Store API keys in a secrets manager once, then hand the AI assistant the variable name, never the value, with anti-mistake validations.
---

# Secrets Manager CLI

## When to use it
When working with an AI assistant in the terminal and you need to use API keys without ever pasting them directly into chat.

## Core principle
The secret lives once in the manager (Doppler or equivalent). The assistant only knows the variable name; the real value never appears in the conversation.

## Set command validations
Rejects an empty clipboard, rejects a variable name pasted as if it were the value, and detects if content changed between copy and use.

## Transcript scanner
Scans past session histories for secrets pasted in by mistake, so they can be rotated immediately.

## .env importer
Migrates stray project .env files into the central manager, leaving the local environment free of sensitive plain text.

## Safety rules
The real value of a secret is never shown in chat or shared logs. Any rotation or deletion of secrets requires explicit user confirmation. Never assume unverified secret values.