1
It says it needs one
The agent finds the provider's template, opens the key page for you, and says which permission to pick. It never logs in, passes 2FA or pays.
What happens when an agent needs a key
2
You copy, then click Save
KeyKeeper checks the value looks like a Stripe key before writing, stores it in the Keychain, and verifies it with a read-only request the agent never sees.
3
The task goes on
The key goes into the command's environment through keykeeper run, and only there. Approve once, for this run, or for good — and revoke any time.
keykeeper import ./.envAlready have a .env? One command moves it in — secrets to the Keychain, settings beside them, the file left for you to delete.
