# Try it with a harmless value.

Walk through the command once, using a setting that cannot unlock anything.

Once Keyhole is installed, try the flow with an invented value before using a real credential. Use a new practice folder so you can recognize what changes. See the [overview](https://jlumbroso.github.io/keyhole-docs/index.html) for release status and requirements.

 

## Try a harmless value

 

1. Open the practice folder in VS Code. Keyhole writes to that folder's `.env`. If several local folders are open, the command asks which one to use.
2. Choose **View → Command Palette…** from VS Code's menu, then search for `Keyhole: Set a Secret in .env…` and select it.
3. Enter the variable name `KEYHOLE_PRACTICE` and press Enter. Names use capital letters, digits, and underscores, and start with a letter.
4. Read any Git message before continuing. If Git does not ignore `.env`, Keyhole offers `Add to .gitignore`. Choosing it adds an ignore rule and checks again. If Git reports that it already tracks the file, Keyhole stops; follow [Git tracks the file](https://jlumbroso.github.io/keyhole-docs/troubleshooting.html#git-tracks-the-file) before continuing. A repository VS Code cannot open also stops the write. When no repository is detected, the write is allowed; see [folders without Git](https://jlumbroso.github.io/keyhole-docs/troubleshooting.html#no-git-repository).
5. Enter the practice value `not-a-secret`. The box masks what you type. The eye button shows the value; selecting it again hides the value. Switching away from the VS Code window also hides a revealed value.
6. Press Enter to save. Look for the message beginning `Keyhole set KEYHOLE_PRACTICE in`. It names the destination and gives the value's length without displaying the full value.

 

Keyhole appends the setting beneath a comment recording when it wrote it. The success message confirms a file write. It does not confirm that a running program loaded the setting or that a service accepted it.

 

## Use a real setting

 

First configure your assistant's [file protections](https://jlumbroso.github.io/keyhole-docs/keeping-secrets-out-of-the-conversation.html). Then repeat the steps in your actual project, using the variable name the project expects and the value from the service. Paste the value into Keyhole, not the chat.

 

If the program reads `.env` when it starts, restart that program after saving. Check the task you were trying to perform. Ask for a result such as “setting present” or “connection succeeded,” without printing the value.

 

> Saving a local `.env` does not configure a hosted application. If the program runs on a hosting service, follow that service's instructions for its environment settings.

 

## Set a new value for an existing name

 

If the name is already set, Keyhole asks whether to `Set New Value`. Choosing it opens the value box and, after you submit, appends another assignment. A comment identifies the earlier line it supersedes. The old value stays in the file.

 

Cancel keeps the existing assignment. After you confirm that the new value works, you may remove the old line locally. Removing a line does not revoke the old credential at its service.

 

## Cancel or pause

 

If you cancel before submitting the value, Keyhole does not save that value to `.env`. An ignore rule you already approved may remain in `.gitignore`.

 

The value box stays open when you switch to another application, and a revealed value becomes masked again. If you close the box, run the command again when you are ready; this version does not save a draft.

 

If the result differs from these steps, see [Troubleshooting](https://jlumbroso.github.io/keyhole-docs/troubleshooting.html).

## Chapter notes

**Practice value**

not-a-secret is deliberately harmless. Keep real credentials out of screenshots and chat.

**After saving**

A saved file does not establish that your program has loaded it.

Keyhole 0.1.0 · previews labeled separately. Updated 24 October 2026. [Online chapter](https://jlumbroso.github.io/keyhole-docs/first-secret.html). [Source reference](https://github.com/jlumbroso/keyhole/blob/main/docs/manual/content/first-secret.html).

Source access currently requires a repository invitation.