Exchange Space

Exchange Space solves one problem: an agent needs credentials, but they must not appear in prompts or transcripts.

You store credentials here; the runtime injects them as environment variables or files. The agent can use them but never sees the plaintext.

Platforms and entries

Platform (a set of related credentials, e.g. acme-cloud)
  ├─ Variable (NAME=value, injected as an env var)
  └─ File (written to a credential directory; an env var points at the path)

Create a platform

1. Open Exchange Space → New platform.
2. Fill in:
   • Slug — lowercase letters, digits, -, _; part of the file path.
   • Display name — for humans.
   • Description — goes into the prompt so the agent knows what these credentials are for.
   • Docs — optional title + link; goes into the prompt, not the container.
3. Save.

Add entries

Under the platform, choose Add variable or Add file:

Type	Fields	Effect
Variable	Name, value, comment	Injected as an env var of the same name
File	Filename, content, optional env var name	Written into the credential directory; the env var points at it

Rules:

• Values are masked after saving. Leave the field empty while editing to keep the current value.
• Variable names must follow env-var rules (letter or underscore first).
• Entries and platforms can be enabled/disabled independently; disabled means not injected.

Use at runtime

Inside the sandbox the agent can read the variable directly:

echo "$ACME_API_KEY"

File entries land in the credential directory; the env var points at the path.

Security advice

• One platform per related credential set, so you can disable it as a unit.
• Never paste secrets into the conversation; read them from env vars.
• Rotate regularly; edit the entry and leave other fields empty to keep existing values.

FAQ

The agent cannot see a variable — confirm both the entry and platform are enabled, and that the session’s sandbox reloaded the configuration.

A file is missing — check filename and variable name; empty content creates nothing.

Temporarily disable a key — disable the entry instead of deleting it.