Secrets

API keys, tokens and files that every Mac of the account receives. A person enters each one once, and the agent's chat never sees it.

Add a secret

In the browser

At nomac.app/secrets.

In a terminal

nomac secrets set NAME, or every line of a file with --from-env-file .env.

Through a link

Your agent calls request_secret and gives you a link. Whoever holds the value (you, a teammate, a client) enters it once within 24 hours, with no NoMac account.

nomac secrets set ANTHROPIC_API_KEY
nomac secrets set --from-env-file .env

On the Mac

• Variables are in the environment of every command, SSH session and login shell.
• Files go to their path: ~/.nomac/secrets/NAME unless you choose another.
• Values are masked in command output.
• Every new Mac receives them. install_secrets (nomac secrets install) puts a new or changed one on a running Mac. A secret marked on request is installed only when named.

Apple keys stay on NoMac

The App Store Connect key you add at nomac.app/apple is not a secret on the Mac. It stays on NoMac's server, where the signing and TestFlight tools use it. Store the .p8 as a secret file only if your own tools, such as fastlane or Transporter, need it; then every Mac has it.