secrets:give

secrets family

Give a key to ONE. The value arrives sealed on the giver's side to ONE's lock alone (read from ONE's vault, never a constant) and signed by a key on the vault's grant-signers; the opener checks the signature, opens the key in memory, refuses a signed subject that is not the attested caller and a sealed plaintext that does not name this give's vault, name and provider, makes ONE cheap Check it call to the provider row's check entry, flags a key that can make other keys (or whose scopes cannot be read), and stores the sealed key keyed `<vault>/<name>` — by compare-and-set on the record it replaces — with the row's host, header and entries as they are now. Afterwards only the last four characters show. The giver is the session or attested agent — a body field never names it. Closes with a mark on `actor → provider:<name>`, a warn on any refusal.

Effect: ask; Awaits an outcome — the call returns the response below.
Caller: authenticated; The class of authority the caller must already hold, decided from the attested context with no round trip.
Cost: free; What one call costs, so you can budget before acting.
Reversible: no; This cannot be undone. Dry-run it first where the contract allows.
Idempotent: no; Not safe to blind-retry — dedupe on the envelope idempotencyKey.

Send it with your agent

One click hands your coding agent a prompt that registers the substrate, reads this contract, and makes the call. Launch opens the app; the others copy the prompt.

Claude Code

Codex

Cursor

Gemini CLI

Claude Desktop

ChatGPT

curl -X POST https://one.ie/api/ask/secrets:give \
  -H "Authorization: Bearer $ONE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": { "signer": { "kind": "agent", "sig": "<base64>", "signer": "0x…" }, "payload": { "type": "give", "vault": "0x…", "body": { "name": "OPENAI_API_KEY", "provider": "openai", "sealed": "age:…", "mode": "give", "replaces": null, "subject": { "kind": "actor", "id": "<your actor id>" } } } }}'

The key is never in a link. npx -y @oneie/cli login writes it to ~/.config/oneie/key on your machine.

Request

Validated before dispatch — an invalid payload is refused with the fix, never half-applied.

signer object required
payload object required
group string optional C13: give the key to a group the caller signs for. Refused `not_built (C13)` until the group walk lands.

Response

What comes back from the call.

ok boolean
stored boolean false on mode check — nothing was written.
given object What ONE kept: the last four characters (empty for a value shorter than 12), the flag word if any, Check it's status, and the give's sigHash — what a rotate signs as `replaces`.
refused string The opener's refusal: malformed · unknown_provider · bad_signature · cannot_verify · subject_mismatch · busy (10 gives a minute per caller, then per vault) · stale · not_sealed_to_one · seal_mismatch · bad_key · check_failed · flagged.
detail string The check that bit — never the value or its length. On stale: the sigHash of the record ONE holds (`none` when there is none).
error string The web side: unauthorized · not_in_workflow (a workflow step never gives a key in the runner's name) · bad_request · not_built (C13) · opener_unbound · opener_unreachable.

Traffic

Every call to secrets:give, counted where it is dispatched — over HTTP or in-process alike. Aggregate only — no actor, no payload, no workspace.

Counting…

Wiring

Every place in the open source that names secrets:give, and the file that answers it. Read from the tree at build time — a receiver is reached by NAME through one door, so there is no import edge to follow and a grep is the honest shape of the question. Structure, not volume — the count is in Traffic above.

Called from

API route 2

one.ie/web/src/lib/receiver-index.generated.ts:326
one.ie/web/src/lib/resolvers/secrets.ts:30

CLI 1

packages/cli/src/secrets-give.ts:21

SDK 1

packages/sdk/src/secrets-give.ts:22

→

Answered by

secrets:give one.ie/web/src/lib/resolvers/secrets.ts:222 Dispatched through POST /api/ask/secrets:give, after the envelope validates the payload.

secrets family · 2 more

secrets:call secrets:used

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "signer": {
      "type": "object",
      "properties": {
        "kind": {
          "type": "string",
          "enum": [
            "person",
            "agent"
          ],
          "description": "agent: its own ed25519 Sui key (the CLI's --signer-key, the SDK's giveData). person: a passkey touch made on the seal page (C9) — the master-derived key never signs."
        },
        "sig": {
          "type": "string",
          "description": "The signature over the payload's canonical bytes (keys sorted, @oneie/sdk/secrets) — a Sui personal-message signature (agent) or the WebAuthn assertion JSON (person)."
        },
        "signer": {
          "type": "string",
          "description": "Who signed: the agent's Sui address, or `p256:<point>` for a passkey. It must be on payload.vault's grant-signers, read from the chain."
        }
      },
      "required": [
        "kind",
        "sig",
        "signer"
      ]
    },
    "payload": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "const": "give"
        },
        "vault": {
          "type": "string",
          "description": "The giver's Sui vault, `0x` + 64 lower-case hex. Its grant-signers decide who may give; the key is stored as `<vault>/<name>` and nobody listed on another vault can change it."
        },
        "body": {
          "type": "object",
          "properties": {
            "name": {
              "type": "string",
              "description": "The .env name, e.g. OPENAI_API_KEY — letters, digits and `_`."
            },
            "provider": {
              "type": "string",
              "enum": [
                "openai",
                "anthropic",
                "stripe",
                "github",
                "dataforseo",
                "composio"
              ],
              "description": "A row of secrets/src/providers.ts; anything else refuses unknown_provider before the chain is read."
            },
            "sealed": {
              "type": "string",
              "description": "Sealed to ONE's lock and no other reader (`age:<base64>`, the @oneie/sdk/secrets-give sealForOne form) over the canonical plaintext `{\"name\",\"provider\",\"v\":1,\"value\",\"vault\"}` naming this give's vault, name and provider — any other is seal_mismatch. Never the value."
            },
            "mode": {
              "type": "string",
              "enum": [
                "give",
                "check"
              ],
              "description": "check: verify, open and Check it, answer, and store nothing."
            },
            "allowFlagged": {
              "description": "Signed with the rest: store a key Check it flagged — admin_key · full_secret_key · admin_scope · key_scope (a key that can make other keys or reach admin), or scopes_unknown (a GitHub token whose scopes cannot be read).",
              "type": "boolean"
            },
            "replaces": {
              "anyOf": [
                {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                {
                  "type": "null"
                }
              ],
              "description": "Signed with the rest: the sigHash of the record this give replaces (`given.sigHash` of the last give, or a stale refusal's detail), null for a first give. Anything else refuses stale — a captured give re-sent after a rotate never rolls it back."
            },
            "subject": {
              "type": "object",
              "properties": {
                "kind": {
                  "type": "string",
                  "const": "actor"
                },
                "id": {
                  "type": "string"
                }
              },
              "required": [
                "kind",
                "id"
              ],
              "description": "Signed with the rest: the giver's own actor — the caller this request is attested as (session, world key or attested agent). Any other refuses subject_mismatch, so a captured give resent under another session is never theirs."
            }
          },
          "required": [
            "name",
            "provider",
            "sealed",
            "mode",
            "replaces",
            "subject"
          ]
        }
      },
      "required": [
        "type",
        "vault",
        "body"
      ]
    },
    "group": {
      "description": "C13: give the key to a group the caller signs for. Refused `not_built (C13)` until the group walk lands.",
      "type": "string"
    }
  },
  "required": [
    "signer",
    "payload"
  ]
}

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "stored": {
      "description": "false on mode check — nothing was written.",
      "type": "boolean"
    },
    "given": {
      "description": "What ONE kept: the last four characters (empty for a value shorter than 12), the flag word if any, Check it's status, and the give's sigHash — what a rotate signs as `replaces`.",
      "type": "object",
      "properties": {
        "vault": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "provider": {
          "type": "string"
        },
        "last4": {
          "type": "string"
        },
        "flagged": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ]
        },
        "check": {
          "type": "object",
          "properties": {
            "ok": {
              "type": "boolean"
            },
            "status": {
              "type": "number"
            }
          },
          "required": [
            "ok",
            "status"
          ]
        },
        "sigHash": {
          "type": "string"
        }
      },
      "required": [
        "vault",
        "name",
        "provider",
        "last4",
        "flagged",
        "check",
        "sigHash"
      ]
    },
    "refused": {
      "description": "The opener's refusal: malformed · unknown_provider · bad_signature · cannot_verify · subject_mismatch · busy (10 gives a minute per caller, then per vault) · stale · not_sealed_to_one · seal_mismatch · bad_key · check_failed · flagged.",
      "type": "string"
    },
    "detail": {
      "description": "The check that bit — never the value or its length. On stale: the sigHash of the record ONE holds (`none` when there is none).",
      "type": "string"
    },
    "error": {
      "description": "The web side: unauthorized · not_in_workflow (a workflow step never gives a key in the runner's name) · bad_request · not_built (C13) · opener_unbound · opener_unreachable.",
      "type": "string"
    }
  },
  "required": [
    "ok"
  ]
}