Variables and credentials in a desk

A variable is a named value for the Apps and agents in a scope: you, a workspace or the organization. It's plain or secret. A secret is write-only once saved: nobody sees it again in the Console. Variables and connections share one set of names (Connections).

Add a variable#

1. Open Variables in the workspace and press Add variable.
2. Give it a Name, such as POSTGRES_PASSWORD.
3. Leave Secret on for a password or a key, or turn it off for a plain value, such as a hostname.
4. Choose who can use it, as for a connection: Only me, This workspace or The whole organization.

When two have the same name, yours wins over the workspace's, and the workspace's over the organization's. The list says so: a variable a narrower one hides shows Hidden by with the one that wins.

You can also save a secret while you launch, with New secret… under Environment (Launch and manage Instances).

Read one on a desk#

A desk whose App was launched with its own identity, as every agent's desk is, reads the variables in reach with uremot var:

uremot var list    # what it can read: names and how to use each, never values

Read a value only inside the command that uses it, never on its own: a value printed in a desk's terminal is on the screen everyone watching sees. For example:

PGPASSWORD="$(uremot var get POSTGRES_PASSWORD)" psql -h postgres -U postgres

Never put a value into a file, a commit or a chat.

• Git asks the platform for repository credentials through uremot var git, the credential helper a desk sets up, so a clone or a push over https uses your GitHub connection.
• GitHub and GitLab CLIs: uremot tool gh and uremot tool glab fetch, verify and run the provider's CLI on first use.
• A model provider's key for a side job, such as a classifier, without handing it to the agent's harness: uremot var run --provider <provider> --connection <name> --model <provider>/<model> -- <command> puts only that connection's key in the command's environment. --model may be left out for Z.AI only, and --check checks the connection can be used without fetching anything or running the command.

For your AI#

The uremot-connections skill shows an agent what's in reach and how each program uses it, without exposing a value: uremot-connections.