# Let your assistant start the handoff. Your assistant prepares the instructions and requests the setting. You supply the value outside the conversation. > **Keyhole 0.1.0 is available.** Install it from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=jlumbroso.keyhole) or [Open VSX](https://open-vsx.org/extension/jlumbroso/keyhole), or run the command below. This release provides manual entry into `.env`. ``` code --install-extension jlumbroso.keyhole ``` Your assistant can build the integration, but a step may still need you: signing in to a service, authorizing access or supplying a token. Keyhole gives the assistant a way to initiate that handoff. Its companion [Porthole](https://jlumbroso.github.io/porthole/) can display the instructions beside your work. The assistant requests a setting by name. You obtain its value and enter it in Keyhole's masked box. The value goes into the project without passing through the conversation. > **Released and preview.** Keyhole 0.1.0 supports manual entry into `.env`. Assistant-triggered requests and a status MCP are implemented in an unreleased preview. Harness-specific settings writers are still to come. The [model reference](https://jlumbroso.github.io/keyhole-docs/for-assistants.html) separates these interfaces. ## Choose your starting point - [Try Keyhole with a harmless value](https://jlumbroso.github.io/keyhole-docs/first-secret.html) before introducing a real credential. - [Connect a Render MCP server](https://jlumbroso.github.io/keyhole-docs/render-mcp.html) to help your assistant work with Render services. - [Connect a Neon MCP server](https://jlumbroso.github.io/keyhole-docs/neon-mcp.html) to help your assistant work with Neon projects and databases. - [Give your assistant the exact trigger commands](https://jlumbroso.github.io/keyhole-docs/for-assistants.html), request format and status contract. - [Find the right assistant configuration](https://jlumbroso.github.io/keyhole-docs/assistant-settings.html) for Claude Code, Codex, Gemini CLI or Grok Build. The service guides start with the task and authorization method. If the MCP offers browser sign-in, you may not need to copy a token at all. ## A name and a value A setting has two parts. Its name, such as `DATABASE_URL`, tells the program which setting it is. Its value is the connection string, key, or other information supplied by the service. Discuss the name with your assistant. Enter the value in Keyhole. Before obtaining a credential, ask which service and credential type the project needs, what it will use it for, and the exact variable name it expects. A database connection string and an account-management API key serve different purposes, even when both come from the same provider. ## What Keyhole does Run `Keyhole: Set a Secret in .env…` from VS Code's Command Palette. Keyhole asks for the variable's name, checks Git's tracking and ignore rules when a repository is present, and takes the value in a masked input box. It appends the setting to the selected folder's `.env`. If it finds a repository VS Code cannot open, it refuses the write. [A folder without a detected repository can receive a value](https://jlumbroso.github.io/keyhole-docs/troubleshooting.html#no-git-repository). In this first command flow, you start the command yourself. The preview adds [requests an assistant can trigger](https://jlumbroso.github.io/keyhole-docs/for-assistants.html#request-link); it still writes to `.env`. Neither build writes directly to an assistant's settings file yet. `.env` is an ordinary text file. Your program must be configured to read it. Writing this local file does not update the settings of a deployed service. ## Saved, loaded, and accepted are different 1. Saved: Keyhole wrote the setting to `.env` and checked the result. 2. Loaded: the program read that file and received the setting. A program that reads settings at startup needs to restart. 3. Accepted: the service accepted the credential for the operation you tried. Keyhole's success message confirms the first step. Check the program's behavior to establish the other two, without printing the value. ## Before using a real secret Follow [Keep secrets out of the conversation](https://jlumbroso.github.io/keyhole-docs/keeping-secrets-out-of-the-conversation.html) for the application running your assistant. Keyhole omits the full value from its own messages and logs, but another tool with file access may still read `.env`. The file is not encrypted. Git ignore rules help prevent future commits. They do not prevent reads, and they do not remove a secret from an earlier commit. ## What you need - VS Code desktop 1.134.0 or later. - Your project open as a local folder. - Git installed and VS Code's built-in Git extension enabled. Hand checks recorded so far cover macOS with VS Code 1.141.0. Windows and Linux have not been checked. If a step does not work, start with [Troubleshooting](https://jlumbroso.github.io/keyhole-docs/troubleshooting.html). Share the variable's name and the message you saw, without the value or a copy of `.env`. ## Chapter notes **Name, not value** Your assistant can discuss DATABASE_URL without seeing the connection string. **Start harmlessly** Use the practice setting before introducing a real credential. Keyhole 0.1.0 · previews labeled separately. Updated 24 October 2026. [Online chapter](https://jlumbroso.github.io/keyhole-docs/index.html). [Source reference](https://github.com/jlumbroso/keyhole/blob/main/docs/manual/content/overview.html). Source access currently requires a repository invitation.