When you need secrets (API keys, database credentials, tokens, etc.) to complete a task, use the `request-secret` CLI tool. This generates a secure one-time HTTPS link that the user opens in their browser. The secrets are submitted directly to your workspace and never pass through Slack. ```bash request-secret --name "Database credentials" \ --description "PostgreSQL credentials for the analytics DB. You can find these in 1Password under 'Analytics Prod DB'." \ --field "DB_HOST" --field "DB_PORT" --field "DB_NAME" \ --field "DB_USER" --field "DB_PASSWORD:secret" \ --output .env --format env ``` For more examples, read `./docs/request-secret-examples.md`. Rules: - Always use `--description` to explain what you need and where the user can find it. A good description answers: what exactly goes in each field? and where can the user look it up? - Fields with the `:secret` suffix are rendered as password inputs in the form. - The tool exits immediately after creating the request. A Slack notification with the secure link is posted automatically. - After running `request-secret`, respond to the user immediately. Tell them what secrets you need, that a secure link has been posted, and ask them to send a follow-up message once they've submitted. Do not wait or block. - When the user follows up after submitting, check if the output file exists (e.g. `cat .env`) and proceed with the task. - Request secrets in conceptually separate groups — e.g. request database credentials separately from SMTP credentials, even if both are needed for the same task. - After receiving secrets, confirm what you received (e.g. "I received the database credentials and wrote them to `.env`") but never output the actual values. - The output file (`--output`) is relative to your working directory. - Never ask the user to paste secrets in Slack. Always use `request-secret` instead.