Onboarding a New Developer

Onboarding a new developer to a team using traditional secrets management (like .env files) usually involves searching a password manager, asking teammates on Slack, or copying credentials over email. These approaches are insecure, error-prone, and slow.

With AgentSecrets, onboarding a developer takes less than a minute, provides end-to-end zero-knowledge security, and requires zero direct sharing of credential values.

Step-by-step onboarding flow

The onboarding flow relies on the AgentSecrets client-side cryptosystem. When you invite a developer, their local client negotiates a key exchange with the workspace.

Admin sends the invite: The workspace administrator runs the invite command:
```
agentsecrets workspace invite new-developer@acme.com
```
Developer is added immediately: The invitation immediately adds the developer to the workspace (gated behind administrative password confirmation).
Developer logs in: The developer logs in using the CLI to automatically sync the workspace.

What the new developer runs

The developer needs to run a few simple commands to set up their machine, join the workspace, select the storage mode, and pull the latest secrets.

Install the CLI:
```
brew install The-17/tap/agentsecrets
```
Log in or register:
```
agentsecrets login
```
Logging in automatically retrieves, decrypts, and caches the keys for the workspace they were invited to.

Initialize local workspace and select storage mode: Run the initialization command. This will prompt the developer to choose their preferred storage mode:

agentsecrets init

Alternatively, they can specify the storage mode directly:

# Keychain Mode (Recommended: stores secrets directly in OS Keychain)
agentsecrets init --storage-mode 1

# Standard Mode (Writes secrets to a local .env file)
agentsecrets init --storage-mode 2

Pull the secrets:
```
agentsecrets secrets pull
```

Because AgentSecrets uses client-side end-to-end encryption, credential values are never shared in plaintext.

Direct OS Keychain integration: In Keychain mode, pulled secrets are injected directly into the operating system's native keychain (such as macOS Keychain, Windows Credential Manager, or Linux libsecret). They are never written to disk in plaintext.
Zero-knowledge sync: Secrets are encrypted on the admin's machine using the workspace key. When the new developer accepts the invite, the workspace key is encrypted with their public key. The developer's client decrypts the workspace key locally using their private key and decrypts the secrets. The AgentSecrets servers only ever store and transmit ciphertext.

Verifying they are set up correctly

To ensure the new developer is ready to start coding, they should run:

agentsecrets status

Expected Output:

Logged in as:        new-developer@acme.com
Session:             Active (expires 7 hours from now)
Selected Workspace:  Acme Engineering
Environment:         development
Current Project:     payments-service
Secrets:             12 synced (0 unsynced)

They can now start the proxy or run their development server with environment variables injected:

# Start proxy for AI agents
agentsecrets proxy start

# Run development server with secrets injected
agentsecrets env -- npm run dev

Onboarding a New Developer

Step-by-step onboarding flow

What the new developer runs

No .env sharing required

Verifying they are set up correctly