Try it with a harmless value.

Once Keyhole is installed, try the flow with an invented value before using a real credential. Use a new practice folder so you can recognize what changes. See the overview for release status and requirements.

Try a harmless value

1. Open the practice folder in VS Code. Keyhole writes to that folder's .env. If several local folders are open, the command asks which one to use.

2. Choose View → Command Palette… from VS Code's menu, then search for Keyhole: Set a Secret in .env… and select it.

3. Enter the variable name KEYHOLE_PRACTICE and press Enter. Names use capital letters, digits, and underscores, and start with a letter.

4. Read any Git message before continuing. If Git does not ignore .env, Keyhole offers Add to .gitignore. Choosing it adds an ignore rule and checks again. If Git reports that it already tracks the file, Keyhole stops; follow Git tracks the file before continuing. A repository VS Code cannot open also stops the write. When no repository is detected, the write is allowed; see folders without Git.

5. Enter the practice value not-a-secret. The box masks what you type. The eye button shows the value; selecting it again hides the value. Switching away from the VS Code window also hides a revealed value.

6. Press Enter to save. Look for the message beginning Keyhole set KEYHOLE_PRACTICE in. It names the destination and gives the value's length without displaying the full value.

Keyhole appends the setting beneath a comment recording when it wrote it. The success message confirms a file write. It does not confirm that a running program loaded the setting or that a service accepted it.

Use a real setting

First configure your assistant's file protections. Then repeat the steps in your actual project, using the variable name the project expects and the value from the service. Paste the value into Keyhole, not the chat.

If the program reads .env when it starts, restart that program after saving. Check the task you were trying to perform. Ask for a result such as “setting present” or “connection succeeded,” without printing the value.

Set a new value for an existing name

If the name is already set, Keyhole asks whether to Set New Value. Choosing it opens the value box and, after you submit, appends another assignment. A comment identifies the earlier line it supersedes. The old value stays in the file.

Cancel keeps the existing assignment. After you confirm that the new value works, you may remove the old line locally. Removing a line does not revoke the old credential at its service.

Cancel or pause

If you cancel before submitting the value, Keyhole does not save that value to .env. An ignore rule you already approved may remain in .gitignore.

The value box stays open when you switch to another application, and a revealed value becomes masked again. If you close the box, run the command again when you are ready; this version does not save a draft.

If the result differs from these steps, see Troubleshooting.