> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withmethod.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Declare the keys that scripts need. Values stay on the computer that runs the Method.

A Method declares each key by name and purpose under `secrets:`. The value is never in the Method file, and it is never sent to Method. From the shipped `support-triage` example:

```yaml theme={null}
secrets:
  HELPDESK_TOKEN: API token for the help desk. read-ticket.mjs and set-ticket.mjs send it as a Bearer token.
```

Every script of the Method (run steps, script checks, tools, and observers) gets all declared secrets as environment variables. A missing value stops the run before its first step, with `missing_secret` and the missing names.

## Give this computer the values

```sh theme={null}
method secret find support-triage.method
method secret import ../helpdesk/.env HELPDESK_TOKEN
method secret set HELPDESK_TOKEN
method secret list
```

* `find` lists the `KEY=VALUE` files near this folder and the key names in each, never values. It says which declared secrets each file holds and prints the import command.
* `import FILE NAME...` copies the named values from a file that you name. It does not print them.
* `set NAME` opens a private form in your browser (on `127.0.0.1`) for one value. When `$BROWSER` is set, that program opens the link.
* `list` shows each name and where its value is found: the shell, this computer, or missing. It never shows values.

Values are kept in `~/.config/method/secrets.json` (mode 0600). A value exported in the shell comes first.

A coding agent that builds a Method runs `method secret find`, then the `method secret import` command that it prints, and tells you which file each key came from. It does not ask first: the values stay on this computer and do not go into the chat. If no file holds a key, it asks you to run `method secret set NAME`.

## Key files and the Claude Code plugin

The Method plugin for Claude Code checks each `Read`, `Grep`, and `Bash` call before it runs (`method guard-keys`). When the call opens a key file (a `.env` file, `secrets.env`, or Method's secret store), Claude Code asks you first, because the values would go into the chat. A command that runs Method itself, for example `method secret import`, passes unless it names Method's secret store: Method reads key files without showing the values. `.env.example`, `.env.sample`, and `.env.template` are not key files.

## Rules

* Names use capital letters, digits, and underscores. `PATH`, `LANG`, `HOME`, `USER`, `TMPDIR`, and names that start with `METHOD_` are reserved.
* A value of this computer's secrets found in the Method or in one of its files is the error `secret_value`. `method validate` reports it, and `method publish` refuses the version. The issue never shows the value. See [The issue checker](/guides/issues).
* Secret values are replaced with `[REDACTED]` in every run file, `checkpoint.json` too.
* In production, a worker reads declared secrets from its own environment. `method connect` lists the names to set where the app runs. See [Production runs](/guides/production).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.