# Variables and credentials in a desk

A variable is a named value for the Apps and agents in a scope: you, a workspace or the organization. It's plain or
secret. A secret is write-only once saved: nobody sees it again in the Console. Variables and connections share one
set of names ([Connections](/docs/connections)).

## Add a variable

1. Open **Variables** in the workspace and press **Add variable**.
2. Give it a **Name**, such as `POSTGRES_PASSWORD`.
3. Leave **Secret** on for a password or a key, or turn it off for a plain value, such as a hostname.
4. Choose who can use it, as for a connection: **Only me**, **This workspace** or **The whole organization**.

When two have the same name, yours wins over the workspace's, and the workspace's over the organization's. The list
says so: a variable a narrower one hides shows **Hidden by** with the one that wins.

You can also save a secret while you launch, with **New secret…** under **Environment**
([Launch and manage Instances](/docs/instances)).

## Read one on a desk

A desk whose App was launched with its own identity, as every agent's desk is, reads the variables in reach with
`uremot var`:

```sh
uremot var list    # what it can read: names and how to use each, never values
```

Read a value only inside the command that uses it, never on its own: a value printed in a desk's terminal is on the
screen everyone watching sees. For example:

```sh
PGPASSWORD="$(uremot var get POSTGRES_PASSWORD)" psql -h postgres -U postgres
```

Never put a value into a file, a commit or a chat.

- **Git** asks the platform for repository credentials through `uremot var git`, the credential helper a desk sets up,
  so a clone or a push over https uses your GitHub connection.
- **GitHub and GitLab CLIs:** `uremot tool gh` and `uremot tool glab` fetch, verify and run the provider's CLI on
  first use.
- **A model provider's key for a side job,** such as a classifier, without handing it to the agent's harness:
  `uremot var run --provider <provider> --connection <name> --model <provider>/<model> -- <command>` puts only that
  connection's key in the command's environment. `--model` may be left out for Z.AI only, and `--check` checks the
  connection can be used without fetching anything or running the command.

## For your AI

The `uremot-connections` skill shows an agent what's in reach and how each program uses it, without exposing a value:
[uremot-connections](/skills/uremot-connections/SKILL.md).