Give an AI coding agent env vars safely

1. 01

   Give the agent its own token

   Add the agent under Access and create a token for development. Production starts withheld for it, including values you add later, until you allow them by name.

   agent/claude-codeagent

   Its own token, separate from your login.

   token

   envlet_•••••••• shown once

   opens

   one project, one environment

   expires

   always

   production

   withheld

2. 02

   Run the agent through Envlet

   Start the agent with envlet run. It sees the values its token allows and nothing else, and every read shows up under its name.

   Terminal

   ENVLET_TOKEN=envlet_... envlet run -- claude

3. 03

   Allow only what it needs

   For each value, choose shared, a different value for this agent, or withheld. A test Stripe key for the agent and the live key withheld is the usual shape.

4. 04

   Watch the log

   The activity page shows who read what and when. If an agent reads something it should not, you see it the same minute.

5. 05

   Or run the migrate prompt

   With the Envlet MCP server in Claude Code, Cursor, or Codex, the migrate prompt does every step above. Values never enter the conversation.

   Claude Code

   claude mcp add --scope user envlet -- npx -y @envlet/cli mcp

Related

• Claude Code
• Cursor