# Pass secrets safely (/docs/guides-secrets)

Select and rotate the credentials a cell may receive.

Secrets are stored on the host and selected per cell by name. The host does not copy its `.env` file into the VM.

## Declare names in the cell [#declare-names-in-the-cell]

```yaml
secrets:
  - GITHUB_TOKEN
  - CLAUDE_API_KEY
```

Only these names are passed to the container as environment variables. A value may be present in the host's cell environment file and still remain unavailable to the cell unless it is declared here.

## Set or rotate values [#set-or-rotate-values]

`solitary up` asks for missing values. Use the secrets command to set or rotate a value later:

```sh
solitary secrets my-cell
```

The dashboard shows which declared names are set without displaying their values.

## Keep scopes narrow [#keep-scopes-narrow]

Use one cell per task or trust boundary. A GitHub token for one repository should not be shared with every cell, and an API key should not be present in a cell that does not need it.

## Understand the lifecycle [#understand-the-lifecycle]

Selected values become environment variables inside the container, and container metadata may record them inside the VM. Destroying the cell removes that metadata with the VM. The host-held values remain so a replacement cell can be authenticated; rotate credentials if exposure is suspected.