Your first secret
With offprompt installed in a project, ask the agent for something that needs a key:
Set up transactional email with Resend.
The agent calls offprompt
The agent calls collect_secret for RESEND_API_KEY, says why it needs it, and names the
file, .env. Its turn stops inside the call while it waits for you.
A page opens in your browser
offprompt opens a page on 127.0.0.1 by itself. Before you type anything, it tells you:
- who is asking, from the name the agent's host gives: "Claude Code is asking for one value.";
- why, in the agent's own words, marked as its claim;
- which file it will write to, with a warning if that file is not gitignored.
The field is labelled RESEND_API_KEY, with Resend's logo, a link to Resend's API keys page,
and the checks the value has to pass: "starts with re_", "20 to 80 characters".
Each check turns green or red as you type or paste. The write button stays off until every field passes.
Press Write to .env
The page shows Written. and four emoji, a fingerprint it took from what you typed. Compare them with the agent's, then close the tab.
Check the agent's side
The agent gets the key's name, the file, and the same four emoji, taken from what the file now holds. It tells you straight away, before it carries on with the task:
Fingerprint 🍋 🥝 🌮 🧀
offprompt's result opens with that line, so in Claude Code the call's row in the chat starts with
it too. Codex and Pi show the result's text, and there the row starts with a line above the
JSON: Wrote 1 value to .env · fingerprint 🍋 🥝 🌮 🧀. The same four on both sides mean the
file holds exactly what you typed. From here the agent reads the key by name, as
process.env.RESEND_API_KEY, and never opens the file.
Several keys at once
When the agent needs several, they are one page and one wait. Copy them out of your dashboard
and paste the whole block anywhere on the page, or drop a .env file on it. Each value lands
in its own field:
STRIPE_SECRET_KEY=sk_live_abc123
STRIPE_PUBLISHABLE_KEY=pk_live_xyz789
STRIPE_WEBHOOK_SECRET="whsec with spaces"Either every value is written or none is. The page covers pasting, importing and every check in detail.
If you step away
A request lives for five minutes. If you interrupt the agent while it waits, the page stays
live for the rest of that time, and typing the value still writes it. The agent can pick the
request up again with await_secret.