Secrets

Give the daemon the API keys that MCP servers and the spend command need.

The keys that your MCP servers and your [spend] command need come from the daemon’s environment. piloop does not integrate with any secrets manager. You have two options:

• Start piloop serve with the keys set in its environment.
• Set PILOOP_SECRETS_COMMAND to a shell command that prints the keys.

PILOOP_SECRETS_COMMAND

The command prints one NAME=value line for each key. The daemon runs it with sh -c when it starts, and again on each piloop restart and piloop upgrade. So a rotated key is read at the next restart. A key that the command no longer prints stays set until the daemon process exits and starts again, for example with piloop stop and piloop serve, or a restart from the service manager.

• The values go into the daemon’s environment only. piloop never writes them to a file, the database or a log.
• The start fails when the command fails, runs longer than 60 seconds, prints nothing, or prints a line that is not NAME=value, has an empty value or has whitespace in the value. The error names the line or the variable, never the value.
• The command’s stderr goes where the daemon’s stderr goes.

Set it before you create the service unit, and the unit includes it:

PILOOP_SECRETS_COMMAND=~/.config/piloop/secrets.sh piloop service-unit > ~/.config/systemd/user/piloop.service

piloop doctor says where the secrets come from. It runs the command, lists the names that it prints, and names every variable that an MCP server of a project needs and that is still missing.

Examples

A file:

PILOOP_SECRETS_COMMAND='cat ~/.config/piloop/keys.env'

The file holds only NAME=value lines: no comments, no export, and no quotes, because quotes become part of the value.

AWS Secrets Manager, with one secret for each key:

#!/bin/sh
set -eu
for pair in EXA_API_KEY=exa/api-key XAI_API_KEY=xai/api-key; do
  value=$(aws secretsmanager get-secret-value --secret-id "${pair#*=}" --query SecretString --output text)
  printf '%s=%s\n' "${pair%%=*}" "$value"
done

1Password, with op read:

#!/bin/sh
set -eu
exa=$(op read op://Private/Exa/credential)
xai=$(op read op://Private/xAI/credential)
printf 'EXA_API_KEY=%s\nXAI_API_KEY=%s\n' "$exa" "$xai"