Agents need credentials all the time, and when one needs a key, it asks me to paste it into chat. Anything pasted into chat is sent to the model provider and saved in the session log, and I don't want API keys in either place.
creel is a small tool that captures the key somewhere else. When the agent needs a secret, it opens a masked popup in tmux, I paste the key there, and creel writes it into a local .env. The agent gets back a status saying whether the save worked, but never the value.