---
title: Keep secrets off the Machine
description: Let the agent use an API key that never reaches its Machine.
---

Keep a key off the Machine when the agent needs to call a service but should
never hold the real key. The agent's commands get a placeholder, and Polaris
adds the real key to each request on its way to that service. Use it for keys
that would be costly to leak, such as an OpenAI or Anthropic key or a
production API token.

![The Add variable dialog for OPENAI_API_KEY with Secret checked, A placeholder chosen for what commands receive, and https://api.openai.com as the allowed origin.](/docs/screenshots/keep-secrets-off-the-machine.webp)

If the service accepts short-lived credentials, as AWS does, use
[Cloud access](/docs/cloud-access) instead, and no key is stored at all.

## Add an OpenAI or Anthropic key

1. In the Project's **Variables**, or in **Settings → Variables**, choose
   **Add variable**.
2. Pick the OpenAI or Anthropic key name from the suggestions under **Name**,
   and paste the key in **Value**.
3. Under **Commands receive**, choose **A placeholder**. Polaris fills in where
   the key may go.
4. Choose **Save**.

The variable shows **Key off Machine**. Polaris also sets up the official SDK
to send its requests through Polaris, so your code works unchanged. Choose
**Test** in the key's row to check it with one read-only request.

## Add a key for another service

1. Choose **Add variable**, enter a **Name** and paste the key in **Value**.
2. Under **Commands receive**, choose **A placeholder**.
3. In **Allowed origin**, enter the service's address, such as
   `https://api.example.com`. Polaris sends the key there and nowhere else.
4. In **HTTP header**, keep **Authorization (Bearer)**, or choose
   **Custom header** and enter the header the service expects.
5. Choose **Save**.

Your code needs to let you set both the service's address and its key, because
requests go through Polaris on their way to the service.

## Use the key

Polaris tells the agent which keys are kept off the Machine and how to call
them, so the agent uses them without any setup from you.

Each key's row shows **Last used**, the last time Polaris sent it to the
service. To rotate it, choose **Replace** and enter the new key; requests use it
as soon as you save.

## What it protects, and what it doesn't

The real key never reaches the Machine, so the agent has no key to print,
commit or send anywhere else, and Polaris sends it only to the allowed origin.
It doesn't limit what the agent asks that service to do, and if the service
sends the key back in a reply, the reply reaches the Machine unchanged. Give the
service a key with only the permissions the agent needs.

## If the key doesn't work

- A command that was running before the Machine slept can lose the key when it
  wakes: ask the agent to start the command again.
- **OpenAI rejected this key**, or the same for Anthropic: check that the key is
  complete and still active, then **Replace** it.
- **Couldn't reach OpenAI**: the test says nothing about the key. Try again
  later.