# Move existing keys in

Each key goes in once, through a vault page where it is sealed in your browser. Nobody pastes it into chat or a terminal.

## Ask once, not once per machine

A credential lives in the workspace, not on a machine. Every machine you enrol whose scope covers it can use it, so put each key in once, from whichever machine or page is to hand.

Decide first who it belongs to. **Only me** (private, the default for an agent's ask) is for your own keys. **A project** is for a key the project's team shares, and needs `edit` on the project; in a repo with a `mehen.toml`, an agent asks with `--home project`. **Whole workspace** is for owners and admins.

## Two ways in

- **Ask your agent.** It runs `mehen request` (or `vault_request`) and gives you a link; you paste the key on that page. [Ask a human for a credential](https://docs.mehen.dev/guides/request-a-credential.md) shows it from the agent's side.
- **Add it yourself, no agent needed.** In the web app, open **Credentials** and choose **Add a credential**: pick the service (paste a key for a template, or sign in for an OAuth provider), name it, choose where it belongs, and Continue. The next page seals the key in your browser and you confirm with your passkey. A service with no template cannot start there: ask an agent on one of your machines to request it with the service's host (`--host`), and the page asks you to check that destination before anything is saved.

## Then clear out the `.env`

- In a coding project, declare the variable names in `mehen.toml` and point each at its credential with `mehen env set` ([Project variables with mehen run](https://docs.mehen.dev/guides/projects.md)).
- Delete the value from `.env`, and the file once nothing is left in it. Keep a `.env.example` with the names and no values, so people can see what the project needs.
- Bun, Next.js and Vite load `.env` by themselves. `mehen run` does not stop that, so a leftover `.env` still feeds its old values into the program `mehen run` starts.

## Rotate what was exposed

Moving a key into the vault does not make an exposed key secret again. Rotate at the provider, and put the new value in rather than the old one, for any key an agent could already read (a `.env` in a repo an agent works in, a chat, shell history) and any key that sat in a synced or shared file (a cloud drive, a shared folder, a commit).