When an agent needs an API key, I create it on the relevant dashboard. From there, the lowest-friction move is to just paste the key into the chat. But secrets in prompts are bad practice: they’re sent to model providers’ servers and saved in session transcripts.

My flow:

1. Copy the API key to the clipboard.
2. Type opadd [secret_name] into the prompt box.

What happens:

1. A UserPromptSubmit hook fires if any line begins with opadd.

2. Clipboard contents are saved to a temporary file.

3. The secret is piped to the relevant .env file and a 1Password vault that my agent can access.

For the 1Password entry at step (3), the agent cleans the secret name (e.g. capitalisation) and—if the chat makes it clear—adds a note with API scope details.

The code is here.