# Pass credentials to a run

> Store an API token as a secret so every run can read it from its environment without putting it on the command line.

This guide shows how to give runs a credential, such as a Hugging Face or Weights & Biases token.

## 1. Store the secret

Pipe the value in on stdin, or read it from a variable of the same name in your shell:

```bash
printf %s "$HF_TOKEN" | div secrets set HF_TOKEN
div secrets set WANDB_API_KEY --from-env
```

`div secrets set` does not accept the value as an argument, because shell history would keep it.

A new secret goes in the `default` environment and is available to runs and sandboxes. To keep it from sandboxes, pass `--products runs`:

```bash
div secrets set WANDB_API_KEY --from-env --products runs
```

## 2. Read it in the run

Every run in the org gets, as environment variables, every secret in the `default` environment whose products include `runs`:

```python
import os

token = os.environ["HF_TOKEN"]
```

The run's log lists the secrets it received. If the run prints a secret's value, the log shows `••••` in its place.

## Do not use `--env` for credentials

`--env` values are saved with the run and shown in the dashboard. Use `--env` for settings, and secrets for credentials. If both set the same name, `--env` wins.

## Rotate or remove a secret

Setting an existing name replaces the value and keeps its products. `div secrets rm HF_TOKEN` deletes it. Runs that have already started keep the value they received.

## Secrets in other environments

Runs read only the `default` environment. Secrets you set with `--environment` reach only sandboxes created in that environment. See [Keep each customer's credentials in its own environment](https://docs.divergentlabs.xyz/sandboxes/environments.md).

## Related

- [`div secrets`](https://docs.divergentlabs.xyz/compute/cli/secrets.md)