> ## Documentation Index
> Fetch the complete documentation index at: https://piloop.autoresearch.inc/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Give the daemon the API keys that MCP servers and the spend command need.

The keys that your [MCP servers](/guides/mcp-servers) and your [`[spend]` command](/concepts/cost#spend-outside-piloop)
need come from the daemon's environment. piloop does not know any secrets manager. You have two options:

* Start `piloop serve` with the keys set in its environment.
* Set `PILOOP_SECRETS_COMMAND` to a shell command that prints the keys.

## PILOOP\_SECRETS\_COMMAND

The command prints one `NAME=value` line for each key. The daemon runs it with `sh -c` when it starts, and again on
each `piloop restart` and `piloop upgrade`. So a rotated key is read at the next restart. A key that the command no
longer prints stays set until the service manager restarts the daemon.

* The values go into the daemon's environment only. piloop never writes them to a file, the database or a log.
* The start fails when the command fails, runs longer than 60 seconds, prints nothing, or prints a line that is not
  `NAME=value`, has an empty value or has whitespace in the value. The error names the line or the variable, never
  the value.
* The command's stderr goes where the daemon's stderr goes.

Set it before you create the service unit, and the unit includes it:

```bash theme={null}
PILOOP_SECRETS_COMMAND=~/.config/piloop/secrets.sh piloop service-unit > ~/.config/systemd/user/piloop.service
```

`piloop doctor` says where the secrets come from. It runs the command, lists the names that it prints, and names
every variable that an MCP server of a project needs and that is still missing.

## Examples

A file:

```bash theme={null}
PILOOP_SECRETS_COMMAND='cat ~/.config/piloop/keys.env'
```

AWS Secrets Manager, with one secret for each key:

```sh theme={null}
#!/bin/sh
set -eu
for pair in EXA_API_KEY=exa/api-key XAI_API_KEY=xai/api-key; do
  value=$(aws secretsmanager get-secret-value --secret-id "${pair#*=}" --query SecretString --output text)
  printf '%s=%s\n' "${pair%%=*}" "$value"
done
```

1Password, with `op read`:

```sh theme={null}
#!/bin/sh
set -eu
exa=$(op read op://Private/Exa/credential)
xai=$(op read op://Private/xAI/credential)
printf 'EXA_API_KEY=%s\nXAI_API_KEY=%s\n' "$exa" "$xai"
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.