> ## Documentation Index
> Fetch the complete documentation index at: https://resources.athenaintel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret assets: use API keys in code

> Store API keys and tokens in a Secret asset, then read them as environment variables from Python and shell commands in a chat sandbox or a Computer.

A Secret asset holds credentials such as API keys, service tokens, or connection strings. Code reads them as environment variables, so you never paste a key into a prompt or a script.

## What goes in a Secret asset

Write one `KEY=value` assignment per line, in the same format as a `.env` file:

```bash theme={null}
STRIPE_API_KEY=sk-test-123
ORG_ID=org-1
```

Each line becomes one environment variable whose name is the key. Only Secret assets of the key-value type become environment variables.

## Use a secret in a chat

**1. Turn on the sandbox**

The sandbox is what runs code, and it is the only thing that reads secrets. Turn on **Sandbox (execute)** in the chat's agent settings. If the sandbox is off, Athena attaches the secret but warns that its values will not be injected.

**2. Attach the secret**

@-mention the Secret asset in your message, or add it under **Sandbox Secrets** in the agent settings.

**3. Read the keys from code**

Every command the agent runs in the sandbox sees each key as an environment variable, and so does a Python script started from one of those commands.

```python theme={null}
import os

api_key = os.environ["STRIPE_API_KEY"]
```

```bash theme={null}
curl -H "Authorization: Bearer $STRIPE_API_KEY" https://api.stripe.com/v1/balance
```

Values are passed to each command as it runs. They are never written to the sandbox's files, so they don't remain once the run ends.

## Use a secret in a Computer

Link the Secret asset on the Computer's **Startup** tab, or when you create the Computer. The keys are set as environment variables when the Computer starts and again each time it wakes. They are also written to `~/.athena-secrets.env`, so terminals, app servers, and Python scripts all see them.

If you link a secret while the Computer is running, run `source ~/.athena-secrets.env` in a terminal that was already open, or open a new one. See [Computer](https://resources.athenaintel.com/docs/pillars/applications/computer.md) for the rest of the Computer setup.

## Who can use a secret's values

* **Only the person who created a secret can use its values.** If you share a Secret asset, or someone in your workspace can see it, they know it exists but cannot read its keys or use them in their own runs.
* A secret attached to a run is used only when it belongs to the person running it and is in the same workspace. Secrets that are archived, owned by someone else, or in another workspace are skipped, and the run continues without them.
* A Computer that other people can open gets none of its linked secrets.
* Athena never logs secret values.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.