1# Secrets
2
3T3 Code can read credentials from a secret provider, so the credential stays in your password
4manager and T3 Code saves only a reference to it. Agents can also ask you for a secret in a
5private card instead of in the chat.
6
7The Secrets settings page is in preview and is not in every build yet. Secret requests from agents
8work everywhere.
9
10## Secret providers
11
121Password is the supported provider. T3 Code reads secrets with the
13[1Password CLI](https://developer.1password.com/docs/cli/) (`op`), so `op` must be installed and
14signed in on the machine that runs the T3 Code server. When you use T3 Code on another machine or
15from your phone, that is the remote machine, not the device in front of you.
16
17A desktop sign-in asks for approval on that machine, which a remote user cannot answer. On a remote
18or headless server, sign `op` in with a [service account](./secrets-1password-service-account.md) or a
19[Connect server](./secrets-1password-connect.md) instead.
20
21To add one, open **Settings → Secrets**, select **Add provider**, and enter a name and the
221Password account: the shorthand, sign-in address (without `https://`), or ID that
23`op account list` shows. Secret providers belong to the environment you are connected to. Each
24environment keeps its own list.
25
26## Use a secret reference
27
28Credential fields in Settings, such as provider environment variables and credentials, source
29control tokens, usage limit keys, and device host tokens, show a source picker next to the field.
30Pick **Value** to save the credential itself, or pick a secret provider and enter a reference such
31as `op://vault/item/field`. Copy the reference from 1Password with **Copy Secret Reference**.
32Select the check button next to a reference to read it now. If it reads, providers that use it
33start using the new value.
34
35T3 Code reads the secret when it needs it, for example when a provider starts. Change the
36credential in 1Password and refresh to use the new value.
37
38## When a secret cannot be read
39
40If 1Password is locked or signed out, the provider or feature that needs the secret shows an error
41naming the secret provider. Unlock 1Password on the server's machine, then select **Refresh** in
42**Settings → Providers**. T3 Code never replaces a saved credential it cannot read with another
43login.
44
45## Remove a secret provider
46
47When you remove a secret provider in **Settings → Secrets**, T3 Code lists the fields that read
48from it. Removing it clears those fields, so set them again before you need them. The secrets in
491Password are not touched.
50
51## When an agent asks for a secret
52
53An agent that needs a token or password shows a secret request card in the thread instead of asking
54you to paste it into the chat. Type or paste the value and select **Save securely**, or select
55**Decline**. You can answer from web, desktop, or mobile.
56
57If the environment has a secret provider, the card also lets you pick it and enter a reference
58instead of the value. T3 Code reads the secret once, when you answer. If 1Password is locked, the
59card says so and the request stays open: unlock it and try again, or enter the value.
60
61The value never appears in the conversation. Most requests keep it from the agent too: T3 Code
62passes it to the tool that needs it. When an agent has to run a command with the value, the card
63says so instead: the value goes into a private file that the agent's commands can read for about 24
64hours.