# How to safely paste API keys to your agent prompt box

Published: 2026-09-02T00:00:00.000Z
Canonical: https://wow.pjh.is/journal/safely-paste-keys-into-prompt

When an agent needs an API key, I create it on the relevant dashboard. From there, the lowest-friction move is to just paste the key into the chat. But secrets in prompts are bad practice: they're sent to model providers' servers and saved in session transcripts.

My flow:

1. Copy the API key to the clipboard.
2. Type `opadd [secret_name]` into the prompt box.

What happens:

1. A `UserPromptSubmit` hook fires if any line begins with `opadd`.

2. Clipboard contents are saved to a temporary file.

3. The secret is piped to the relevant `.env` file and a [1Password vault that my agent can access](https://wow.pjh.is/journal/login-to-websites-with-codex-and-1password).

For the 1Password entry at step (3), the agent cleans the secret name (e.g. capitalisation) and—if the chat makes it clear—adds a note with API scope details.

The code is [here](https://gist.github.com/peterhartree/ce21a1ff75e44d69017acb0dd39c264e).