📘 Guides

SecureMyAgent Integration

A SecureMyAgent Checkup flags API keys sitting in plaintext in your agent's config files. Plaintext keys cost points on the security score. sma fix --vault moves them into Agent Secret Store.

Move secrets into the vault

1
Install the ass CLI and set an agent key
Use an agent key with secrets:write scope on the target namespace. Create one in Dashboard → Agents.
terminal
npm install -g @agentsecretstore/cli export ASS_AGENT_KEY="ass_..." # an agent key with secrets:write scope

Review the plan

Without --yes, SMA only prints a plan. It never prints a secret value.

terminal

npx -y securemyagent fix --vault

output

2 plaintext secret(s). Values are never printed.

~/.openclaw/openclaw.json:14  anthropic-key  fingerprint 3f9a0c1b7e2d
  store:   ass secrets set openclaw/ANTHROPIC_API_KEY_3f9a0c --type api_key --tier standard   (value on stdin)
  replace: ass tokens issue --scopes secrets:read:openclaw/ANTHROPIC_API_KEY_3f9a0c --ttl 1h
           then give the agent the token and read the value at run time: ass secrets get openclaw/ANTHROPIC_API_KEY_3f9a0c --silent

3
Apply it
With --yes, SMA re-reads each value, checks its fingerprint, and pipes it to ass secrets set on stdin.
terminal
npx -y securemyagent fix --vault --yes
4
Read secrets at run time, then remove the plaintext
Point the agent at the vault, confirm it works, then delete the key from the config file and rotate it with the provider. SMA does not edit your config files.
terminal
export ANTHROPIC_API_KEY="$(ass secrets get openclaw/ANTHROPIC_API_KEY_3f9a0c --silent)" # start the agent from this shell; the key now lives only in its environment

Rotate after you move

A key that sat in plaintext may already have leaked. Once the agent reads it from the vault, rotate it at the provider and store the new value with ass secrets set on the same path.

Coming next

SecureMyAgent attestations are signed with the agent's OpenEntity DID. Once the SecureMyAgent verify API ships, a low security score or a critical finding on an agent's DID will force human approval for its sensitive secrets. Bind the DID to your vault agent now so it's ready.

Agent Identity →

Bind an OpenEntity DID to a vault agent.

Migrate .env files →

Import whole .env files into a namespace.

Secret Rotation →

Rotate credentials without downtime.

CLI Reference →

Every ass command and flag.

Move secrets into the vault

Install the ass CLI and set an agent key

Use an agent key with secrets:write scope on the target namespace. Create one in Dashboard → Agents.

terminal

npm install -g @agentsecretstore/cli
export ASS_AGENT_KEY="ass_..."   # an agent key with secrets:write scope

Review the plan

Without --yes, SMA only prints a plan. It never prints a secret value.

terminal

npx -y securemyagent fix --vault

output

2 plaintext secret(s). Values are never printed.

~/.openclaw/openclaw.json:14  anthropic-key  fingerprint 3f9a0c1b7e2d
  store:   ass secrets set openclaw/ANTHROPIC_API_KEY_3f9a0c --type api_key --tier standard   (value on stdin)
  replace: ass tokens issue --scopes secrets:read:openclaw/ANTHROPIC_API_KEY_3f9a0c --ttl 1h
           then give the agent the token and read the value at run time: ass secrets get openclaw/ANTHROPIC_API_KEY_3f9a0c --silent

Apply it

With --yes, SMA re-reads each value, checks its fingerprint, and pipes it to ass secrets set on stdin.

terminal

npx -y securemyagent fix --vault --yes

Read secrets at run time, then remove the plaintext

Point the agent at the vault, confirm it works, then delete the key from the config file and rotate it with the provider. SMA does not edit your config files.

terminal

export ANTHROPIC_API_KEY="$(ass secrets get openclaw/ANTHROPIC_API_KEY_3f9a0c --silent)"
# start the agent from this shell; the key now lives only in its environment

Rotate after you move

A key that sat in plaintext may already have leaked. Once the agent reads it from the vault, rotate it at the provider and store the new value with ass secrets set on the same path.