Skip to content
Paperclip (w/ CloudCLI)

Secrets

Some jobs need a key or a setting: an API key, a webhook address, a chat ID. Their values go in Paperclip, as secrets on the agent that runs the job. Their names go in the job’s record in git.

So a value never passes through the chat or the repo, and a new server knows what to set up.

Add a secret for a job

Section titled “Add a secret for a job”

  1. Ask for the job as usual. When its skill needs a key, Claude names it, for example STATUS_WEBHOOK_URL, and records the name with the job (--secrets "STATUS_WEBHOOK_URL").

  2. The jobs script says when the agent doesn’t have it yet, and Claude gives you the link:

    "Daily uptime check" needs STATUS_WEBHOOK_URL, which Runner doesn't have yet. The user adds it on Runner's Harness / Runtime page in Paperclip (https://your-paperclip.up.railway.app/JOB/agents/<agent id>/runtime): under Environment variables, Add variable, type the name, then choose "Organization secret" and "Create new secret..." for a key or token, or "Text value" for a plain setting such as a chat ID, and Save changes.

  3. Open that link, or in Paperclip go to Agents, Runner, Harness / Runtime. Under Environment variables, click Add variable and type the exact name.

  4. Choose the value’s kind in the small menu next to it:

    • Organization secret, then Create new secret…, for a key or a token. Paperclip stores it encrypted, and the page shows only its name.
    • Text value for a plain setting, such as a chat ID.

  5. Click Save changes.

  6. Test the job: “run it now and show me the log”.

Claude never asks for a value in the chat, and never writes one into the repo. Don’t paste one in the chat yourself.

The Runner’s Harness / Runtime page in Paperclip, Environment variables: the template’s own GH_TOKEN, GITHUB_TOKEN and CLAUDE_CODE_OAUTH_TOKEN, plus a job’s TELEGRAM_BOT_TOKEN (a secret) and TELEGRAM_CHAT_ID (a text value).

In the record

Section titled “In the record”
{
  "title": "Daily uptime check",
  "prompt": "Run the uptime-check skill.",
  "cron": "0 7 * * *",
  "timezone": "America/Toronto",
  "status": "active",
  "secrets": ["STATUS_WEBHOOK_URL"],
  "paperclipId": "4c0d9b12-6a5e-4f3b-9d77-2b8e1f0a6c31"
}

The names follow the job through renames, moves to another repo, sync and restore. To change a job’s list, ask Claude; --secrets "" clears it.

Good to know

Section titled “Good to know”
  • Secrets belong to the agent, not the job. Every job the Runner runs, in every repo, can read the Runner’s secrets. A name per project, such as TELEGRAM_CHAT_ID_ACME, keeps settings apart, but not access. For a credential only some jobs should reach, see Outside services.
  • The template binds its own secrets on the Runner: CLAUDE_CODE_OAUTH_TOKEN, GH_TOKEN and GITHUB_TOKEN, from the setup page’s Claude and GitHub steps. Leave them; the rest are yours and are kept.
  • Paperclip encrypts secrets with the PAPERCLIP_SECRETS_MASTER_KEY variable. Keep it: without it, they can’t be read.

Paperclip (w/ CloudCLI) is a Railway template by AvgSoft. Paperclip, CloudCLI, Claude Code, Codex and Railway belong to their makers. Template codeDeploy on Railway