# Replace secrets URL: https://docs.hanzo.ai/docs/openapi/environment/put-environment-by-repo-secrets-by-name > Sets one secret on a codebase. `PUT /v1/environment/{repo}/secrets/{name}` > [Environment →](https://docs.hanzo.ai/docs/openapi/environment) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | ----------------------------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/environment/{repo}/secrets/{name}` | | **Method** | `PUT` | | **Operation** | `put_environment_by_repo_secrets_by_name` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Sets one secret on a codebase. The value is sealed in KMS and exported to every later sandbox run on this codebase under its name, a setup run included. It is blinded out of every stream the run publishes, and no route answers it back. Setting a name that is already set replaces its value. Org admin only. ## Request 5 fields, body `application/json` (required). | Field | In | Type | Required | Description | | ------- | ---- | ------ | -------- | ----------------------------------------------------------------- | | `repo` | path | string | yes | Repo is the repository's name in the caller's org. | | `name` | path | string | yes | Name is the environment variable the run exports the value under. | | `name` | body | string | — | Name is the environment variable the run exports the value under. | | `repo` | body | string | — | Repo is the repository's name in the caller's org. | | `value` | body | string | — | Value is sealed in KMS and never answered, logged or echoed. | ## Response | Status | Body | Meaning | | --------- | ----------------------- | ------- | | `200` | environment.Environment | ok | | `default` | problem-details | refused | `200` body — 12 fields. | Field | In | Type | Always | Description | | ------------------ | ---- | -------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `install` | body | string | — | Install is the shell a run executes in its fresh checkout before the agent starts, from the repository root. | | `proposal` | body | environment.Proposal | — | | | `proposal.install` | body | string | — | Install is the install script the agent checked. | | `proposal.note` | body | string | — | Note is what the agent found and checked, in its own words. | | `proposal.secrets` | body | string\[] | — | Secrets are the environment variables the agent found the codebase reads. | | `proposal.start` | body | string | — | Start is the start command the agent checked, or empty. | | `repo` | body | string | — | Repo is the codebase: a repository's name in the caller's org. | | `secrets` | body | string\[] | — | Secrets are the names set on this codebase, each exported to the run's commands under that name. | | `session` | body | string | — | Session is the setup run that produced the proposal, when there is one. | | `start` | body | string | — | Start is the one command a run leaves running in the background once the install has finished — a dev server, a database. | | `state` | body | string | — | State is `none` when nothing is saved or proposed, `proposed` when a setup run's answer is waiting to be reviewed, and `ready` otherwise. | | `updatedAt` | body | string | — | UpdatedAt is when this environment last changed, RFC 3339. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** `hanzo` has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK. **SDK** **.ts** ```ts import { Configuration, EnvironmentApi } from 'hanzoai'; const api = new EnvironmentApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.putEnvironmentByRepoSecretsByName({ repo: 'repo', name: 'name', name: "", repo: "" }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import EnvironmentApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = EnvironmentApi(client).put_environment_by_repo_secrets_by_name(repo='repo', name='name', name="", repo="") ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.EnvironmentAPI.PutEnvironmentByRepoSecretsByName(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, environment_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = environment_api::put_environment_by_repo_secrets_by_name(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.EnvironmentApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new EnvironmentApi(client).putEnvironmentByRepoSecretsByName(); ``` **HTTP** ```bash curl -X PUT https://api.hanzo.ai/v1/environment//secrets/ \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "", "repo": "" }' ``` **MCP** MCP reaches **environment** through the `environment` tool, which names its 4 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_environments" } } }' ``` --- [Environment API](https://docs.hanzo.ai/docs/openapi/environment) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)