Let your assistant start the handoff.

code --install-extension jlumbroso.keyhole

Your assistant can build the integration, but a step may still need you: signing in to a service, authorizing access or supplying a token. Keyhole gives the assistant a way to initiate that handoff. Its companion Porthole can display the instructions beside your work.

The assistant requests a setting by name. You obtain its value and enter it in Keyhole's masked box. The value goes into the project without passing through the conversation.

Choose your starting point

• Try Keyhole with a harmless value before introducing a real credential.
• Connect a Render MCP server to help your assistant work with Render services.
• Connect a Neon MCP server to help your assistant work with Neon projects and databases.
• Give your assistant the exact trigger commands, request format and status contract.
• Find the right assistant configuration for Claude Code, Codex, Gemini CLI or Grok Build.

The service guides start with the task and authorization method. If the MCP offers browser sign-in, you may not need to copy a token at all.

A name and a value

A setting has two parts. Its name, such as DATABASE_URL, tells the program which setting it is. Its value is the connection string, key, or other information supplied by the service.

Discuss the name with your assistant. Enter the value in Keyhole.

Before obtaining a credential, ask which service and credential type the project needs, what it will use it for, and the exact variable name it expects. A database connection string and an account-management API key serve different purposes, even when both come from the same provider.

What Keyhole does

Run Keyhole: Set a Secret in .env… from VS Code's Command Palette. Keyhole asks for the variable's name, checks Git's tracking and ignore rules when a repository is present, and takes the value in a masked input box. It appends the setting to the selected folder's .env. If it finds a repository VS Code cannot open, it refuses the write. A folder without a detected repository can receive a value.

In this first command flow, you start the command yourself. The preview adds requests an assistant can trigger; it still writes to .env. Neither build writes directly to an assistant's settings file yet.

.env is an ordinary text file. Your program must be configured to read it. Writing this local file does not update the settings of a deployed service.

Saved, loaded, and accepted are different

1. Saved: Keyhole wrote the setting to .env and checked the result.
2. Loaded: the program read that file and received the setting. A program that reads settings at startup needs to restart.
3. Accepted: the service accepted the credential for the operation you tried.

Keyhole's success message confirms the first step. Check the program's behavior to establish the other two, without printing the value.

Before using a real secret

Follow Keep secrets out of the conversation for the application running your assistant. Keyhole omits the full value from its own messages and logs, but another tool with file access may still read .env. The file is not encrypted.

Git ignore rules help prevent future commits. They do not prevent reads, and they do not remove a secret from an earlier commit.

What you need

• VS Code desktop 1.134.0 or later.
• Your project open as a local folder.
• Git installed and VS Code's built-in Git extension enabled.

Hand checks recorded so far cover macOS with VS Code 1.141.0. Windows and Linux have not been checked.

If a step does not work, start with Troubleshooting. Share the variable's name and the message you saw, without the value or a copy of .env.