# Give one secret for a time URL: https://getvando.com/docs/guides/one-secret At the end, one command (yours or Claude’s) runs with one secret from your vault, for as long as you chose on your phone, and the secret never appears in Claude’s conversation. You need this computer connected first: [Claude Code in 5 to 8 minutes](https://getvando.com/docs/quickstart/claude-code) does that. ## The example ```bash vando add STRIPE_KEY vando run --secret STRIPE_KEY -- node scripts/refund.js ``` The first line saves the key in your vault. The second asks your phone for it, waits for your Give, and runs `node scripts/refund.js` with `STRIPE_KEY` in its environment. Nothing is written to a file, and the key goes to that one program. ## Save the secret ```bash vando add STRIPE_KEY ``` Where the value comes from depends on where you run it: - **In your own terminal**, it asks for the value with a hidden prompt: `Value of STRIPE_KEY (hidden): `. - **Run by Claude** (no terminal), it opens a page in your browser on this computer. Paste the value there and press Send. The page works once, for 5 minutes, and the value never passes through the terminal or Claude. - With `--on-phone`, nothing is sent from the computer: the first time a command asks for `STRIPE_KEY`, your phone offers to add it. Your phone then shows **Save STRIPE_KEY?** with where it came from (*Pasted in a page on that laptop: check it’s yours.*) and **How careful?**, the level it gets. Tap **Save**. The terminal says `Saved on your phone.` `vando add` refuses a value on its command line (`vando add STRIPE_KEY sk_live_…`) or piped into it: the first stays in your shell history, the second would pass through whatever piped it, an AI’s transcript for one. You can skip `vando add` altogether: if `vando run` asks for a name your vault doesn’t have, your phone offers to add it there. ## Run a command with it ```bash vando run --secret STRIPE_KEY -- node scripts/refund.js ``` Everything after `--` is the command. Your phone gets an ask: - **Who** is asking (Claude Code on your computer), the command and the folder it runs in, marked *said by the laptop*. - **Which secret**: its folder and its level. If you have more than one `STRIPE_KEY`, it asks which; if you have none, it offers to add it. - **For how long**: Once, 1 hour, 8 hours, 1 day or Custom. Tap **Give once** (or **Give for 8 hours**), then do the lock’s steps. The command runs as soon as your phone answers, in the same run. Inside a project with a `.vando.toml`, a name is looked up in the project’s current environment folder. To name one thing anywhere in your vault, give its path: `--secret STRIPE_KEY=Personal/stripe/STRIPE_KEY`. ## How long to give it for | Choice | What it means | | --- | --- | | **Once** | This run only. The next run asks again. | | **1 hour**, **8 hours**, **1 day** | Every `vando run` on this computer that asks for the same secret gets it until then, without asking. | | **Custom** | A number of hours, up to the level’s limit. | The longest you can give depends on the secret’s [level](https://getvando.com/docs/concepts/levels): Easy up to 7 days, Just me up to 1 day, Fort Knox up to 8 hours. Fort Knox starts on Once, and any longer choice says plainly what it means: *anything running as you on that laptop can read it without asking you again*. Things at Two devices can’t be given to a program yet (coming). [Access windows](https://getvando.com/docs/concepts/access-windows) explains the rules behind this. A command can suggest a shorter choice, never a longer one: `--ttl once`, `--ttl 1h`, `--ttl 8h` or `--ttl 1d` pre-selects that chip on your phone. You still choose. ## Waiting, and no If your phone doesn’t answer in time, nothing runs: ```text Waiting for your phone. Run the same command again to continue. vando: pending request=… ``` That is exit code **75**. Without a terminal (Claude’s commands), `vando run` waits 45 seconds; in your own terminal, up to 5 minutes. The ask stays in your Inbox for 10 minutes, so approve it and run the same command again: it picks up the same ask. If you tap Deny: ```text You said no on your phone. Nothing was run. ``` That is exit code **77**. For 5 minutes the same ask is refused without ringing your phone again. The program never started in either case, so a 75 or 77 is always Vando’s, never the program’s own. Every exit code: [the errors reference](https://getvando.com/docs/reference/errors#exit-codes). Want to ask early, before the command is ready? `vando request --secret STRIPE_KEY` sends the ask and returns at once. ## See what this computer can use ```bash vando grants ``` ```text What this computer can use now … until 18:00 · used 3 times ``` Each line is a **grant**: what your phone gave, until when, and how often it was used. Your phone shows the same list under **Connections → Claude Code → Can use now**. ## End it early From the computer: ```bash vando grants end --all ``` `Ended everything this computer could use. Programs that already started keep what they got.` To end one, give its id: `vando grants end `. `vando logout` ends everything, disconnects this computer and removes its keys. From your phone: **Can use now**, the grant, **Revoke**. The switch **Also stop programs it started** (on by default) stops a program `vando run` started with it: `vando` checks once a minute. A grant also ends by itself when its time runs out, when you change the secret’s lock, or when you move it to the Trash. A running program isn’t stopped when its time runs out, unless you started it with `--stop-at-end`. ## What Claude sees When the program’s output goes back to Claude, `vando run` replaces the secret with `[vando:STRIPE_KEY]` and says afterwards: ```text vando: hid STRIPE_KEY in this output 2 times. ``` - **Hiding is best effort.** It catches the value as it is, and its JSON and URL forms. A program that changes the value before printing it (base64, a slice) gets past it, and so does anything written to a file or sent over the network. Output written to a file is never changed. [More](https://getvando.com/docs/security#best-effort). - **Revoke is not recall.** Ending access stops the next run. A program that already read the secret keeps it, and so does an AI that saw it. If that matters, change the secret where you got it. [More](https://getvando.com/docs/security#revoke-is-not-recall). - **While a grant is live, anything running as you on this computer can use it**: your own scripts, your AI, another program. Give it for as short a time as the job needs. [More](https://getvando.com/docs/security#same-user). - **`vando get STRIPE_KEY` prints the value**, so it only works in your own terminal. Your terminal may keep what it showed. ## What can go wrong Every flag of these commands is in the CLI reference: [`vando run`](https://getvando.com/docs/reference/cli#run), [`vando add`](https://getvando.com/docs/reference/cli#add), [`vando grants`](https://getvando.com/docs/reference/cli#grants).
“Name what the command needs: a secret, a folder, or an environment of this project.”
Add `--secret NAME` before the `--`, or run it in a project set up with `vando init`.
“Put the command after --.”
`vando run --secret STRIPE_KEY -- node scripts/refund.js`: the two dashes come before the command.
“Your phone couldn’t give that. Nothing was run.”
The thing can’t go to a program (a Two devices thing, one in the Trash, or a kind that isn’t a secret). Your phone says which, and why.
“That access has ended. Nothing was run. Run the command again to ask your phone.”
The grant ran out or was revoked. Running the command again asks for a new one.
“No browser could be opened here”
`vando add` had nowhere to show its page (a remote shell). Add the secret on your phone instead: the first time a command asks for it, your phone offers to add it.