How-to · secrets

Share one API key across agents without `.env` files

Q: How do I share one API key across several agents safely?

Don't copy it into each .env. Put it behind a proxy: with Meltbox's Secret Proxy you add the key once and each agent calls through Meltbox, which injects the secret server-side. The raw key never reaches the agent, and you scope each agent to only the resources it needs.

Q: What if an agent needs a key it doesn't have?

It files a scope request in-band (mb request-scope) with a reason; you get a one-click approve or reject, and on approval its token's scopes are patched in place.

The same Stripe key is sitting in three repos' .env files, your shell history, and whatever landed in the model's context. There's a cleaner way to let several agents use a key without any of them being able to read it.

Create a free workspace See the live demo

Short answer. Don't copy the key into every .env. Put it behind a proxy. With Meltbox's Secret Proxy you add the key once and each agent calls through Meltbox, which injects the secret server-side — the raw key never reaches the agent, its subprocess, or the model's context. Scope each agent to only what it needs; revoke one by revoking its token.

The problem

A key in every `.env` is a key everything can read

When the credential lives in a file, every agent that opens the repo can read it — and so can any command it runs, your shell history, and the context window it's reasoning in. Rotating means editing every copy. And there's no "this agent, not that one": the key is just present, for anyone in the room.

repo-a/.env · repo-b/.env · repo-c/.env — the same secret, three times

STRIPE_KEY=sk_live_51H...redacted

A shared secrets manager (Vault, Doppler, 1Password) is a real improvement — it centralizes storage and rotation. But at the moment of use it still hands the plaintext secret to the agent as an env var. The agent holds the key. That's the gap a proxy closes.

The fix

Proxy the key — agents use it, never see it

Add the resource once (Settings → Resources — you can paste a .env and it parses into config + secret rows). From then on an agent makes a request through Meltbox and gets the upstream response back; the secret is injected on the server and never crosses to the agent.

an agent calls Stripe without holding the key

mb proxy --resource stripe --env prod \
  --request '{"method":"GET","path":"/v1/subscriptions","query":{"limit":"3"}}'
# Meltbox injects the secret server-side; the agent sees only the response.

scope each agent to exactly what it needs — at invite time

mb invite create --scope proxy:stripe --scope reveal:google-ads \
  --label "marketing agent" --token-ttl 30d
# proxy = call through; reveal = materialize the raw secret (audited), only when an SDK must hold it.

need more access mid-task? ask in-band

mb request-scope bigquery --access proxy --reason "join signups with spend"
# you get a one-click approve / reject; on approval the token's scopes patch in place.

An agent can always see the whole catalog of resources but only use what it's scoped for. When you want to cut one agent off, revoke its token — the key never moves, and every other agent keeps working. For the rare case where a client library must hold the credential, reveal scope materializes it into a subprocess (nothing hits disk) and every reveal is audited.

Why a proxy beats a vault here

A vault answers "where is the key stored and who can check it out." A proxy answers a different question — "can the agent do the job without ever holding the secret?" For autonomous agents whose context you don't fully control, not holding the key is the property that matters.

Side by side

Three ways to give agents a key

	`.env` per repo	Shared secrets manager	Meltbox Secret Proxy
Agent holds the raw key	Yes	Yes (at use)	No (proxy)
Central rotation	No	Yes	Yes
Per-agent scope	No	varies	Yes
Revoke one agent	rotate everywhere	varies	revoke its token
Use audited	No	storage-level	every reveal audited

Meltbox behavior verified against Core concepts — Resources & the Secret Proxy and the mb CLI, July 2026.

FAQ

Common questions

How do I share one API key across several agents safely?

Don't copy it into each .env. Put it behind a proxy: with Meltbox's Secret Proxy you add the key once and each agent calls through Meltbox, which injects the secret server-side. The raw key never reaches the agent, and you scope each agent to only the resources it needs.

Can an agent see the key?

Not with proxy access — the secret stays on the server and only the upstream response comes back. A separate reveal scope exists for the rare case an SDK must hold the credential, and every reveal is audited.

How do I cut off one agent?

Revoke that agent's token. The key never moves and the other agents keep working — unlike rotating a shared key that lived in every .env.

What if an agent needs a key it doesn't have?

It files a scope request in-band (mb request-scope) with a reason; you get a one-click approve or reject, and on approval its token's scopes are patched in place.

Let agents use your keys — not see them

Create a free workspace Watch an agent say hello

Or hand this to your own agent right now:

Read https://docs.meltbox.ai/concepts and https://docs.meltbox.ai/quickstart, then walk me through: creating a free Meltbox workspace at meltbox.ai, adding one API key as a resource (Settings → Resources), and making a proxied call so you use the key without ever seeing it — then push me a brief summarizing what you set up.

More guides

Meltbox vs. building it yourself →Where the .env-everywhere stack breaks. Get a push when Claude Code needs a decision →The notification, with a reply loop. Approve agent actions from your phone →Decide from the lock screen. Zero-inbox for agent output →Triage many agents like email.

Sources

Meltbox Secret Proxy (proxy vs. reveal, scopes, requests): Core concepts, mb CLI, Invite an agent (verified Jul 2026).