Set an .env secret (value never seen by the agent)
set_env_secretAdds secret environment variables to .env files by prompting the user to enter values in a masked dialog, keeping secrets hidden from the agent.
Instructions
Use this WHENEVER a task needs a secret/API key/token/password/connection string/credential written to a project .env file - e.g. "add my OpenAI key", "set DATABASE_URL", "configure my .env", "save this API token". You pass ONLY the variable NAME; the user types the value into a local masked dialog and it is written straight to .env - you never see or handle the value. DO NOT ask the user to paste the secret into the chat; DO NOT write the value or a placeholder yourself; DO NOT cat/read .env to verify (use env_key_exists). The value must be single-line (not for multi-line PEM keys / JSON blobs - for those, tell the user to edit .env manually).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The env var NAME in UPPER_SNAKE_CASE, e.g. OPENAI_API_KEY, DATABASE_URL, STRIPE_SECRET_KEY. | |
| env_path | No | Absolute path to the project .env. Pass the project-root .env path explicitly; if omitted it defaults to <CLAUDE_PROJECT_DIR or cwd>/.env, which may NOT be your workspace when launched via a runner. |