Give an AI coding agent env vars safely

Let Claude Code, Cursor, or Codex run your app without ever seeing a production secret.

About 10 minutes

01
Give the agent its own identity
Create an agent identity and a token for development. Production starts withheld for it, including values you add later, until you allow them by name.
02
Run the agent through Envlet
Start the agent with envlet run. It sees the values for its identity and nothing else, and every read shows up under its name.
Terminal
```
ENVLET_TOKEN=envlet_... envlet run -- claude
```
03
Allow only what it needs
For each value, choose shared, a different value for this agent, or withheld. A test Stripe key for the agent and the live key withheld is the usual shape.
04
Watch the log
The activity page shows who read what and when. If an agent reads something it should not, you see it the same minute.
05
Or say the word
With the Envlet MCP server in Claude Code, Cursor, or Codex, this whole guide is one sentence: move us to Envlet. The agent does every step above, and no value ever enters the conversation.
Claude Code
```
claude mcp add --scope user envlet -- npx -y @envlet/cli mcp
```

Stop pasting .env files.

One command. The right values for whoever runs it.