Choose how to pass credentials

The staging-db secret from Run a command with credentials contains a PostgreSQL password and three connection settings. That works directly with psql, but other commands may already know their connection settings or expect a different password variable. You can adapt delivery for each command without changing the stored secret.

The examples below assume your computer is paired and staging-db has PGHOST, PGUSER, PGDATABASE, and a sensitive PGPASSWORD. Keep its approval mode at Ask while trying them. Substitute your own host, account, and database wherever the commands use example connection details.

Give a command only the password

Suppose a diagnostic script already specifies the host, user, and database. It only needs Agentknock to provide PGPASSWORD. You can try that arrangement directly:

agentknock -s staging-db \
  --only-env staging-db PGPASSWORD \
  --reason "Check the staging database connection" \
  -- psql -X -w -A -t \
    -h db.example.test -U app_reader -d app_staging \
    -c 'SELECT current_database();'

Review the request on your phone and choose Allow once. The phone returns only PGPASSWORD from this secret, and psql reads the other connection settings from its arguments. A successful connection prints app_staging for the example database.

The stored secret still has all four variables. Non-sensitive values may remain available to AI review as context even when you do not deliver them to the command. Selection controls the requested delivery; it does not reclassify a stored value as private.

Use the same password with Flyway

Now you want to inspect migration status with an installed Flyway CLI. Flyway accepts its database password through FLYWAY_PASSWORD. Your phone currently stores that value as PGPASSWORD.

Run this from your Flyway project, using its default environment and the appropriate connection URL and user:

agentknock -s staging-db \
  --only-env staging-db PGPASSWORD \
  --rename-env staging-db PGPASSWORD FLYWAY_PASSWORD \
  --reason "Inspect staging migration status" \
  -- flyway \
    -url=jdbc:postgresql://db.example.test:5432/app_staging \
    -user=app_reader info

On the phone, check that the command is flyway with the intended database and info operation, then choose Allow once. Flyway connects using the approved password and displays the migration status for your project. Its output depends on the migrations already present.

The rename applies only to this invocation. PGPASSWORD remains the stored name, so the earlier psql command continues to work. Pairing the rename with --only-env also avoids adding the other three PostgreSQL variables to Flyway’s environment. If your project uses a named Flyway environment, use the password variable documented for that environment instead.

Send a registry password to standard input

Some tools offer a dedicated password input stream. For example, Docker supports docker login --password-stdin.

For this separate task, create or import an environment secret named registry with a sensitive variable named PASSWORD. Store a registry access token or password that belongs to the account you will use. Then run, substituting your registry host and username:

agentknock -s registry \
  --only-env registry PASSWORD \
  --stdin registry PASSWORD \
  --reason "Sign in to the container registry" \
  -- docker login --username example-user \
    --password-stdin registry.example.com

Approve the login request on your phone. Agentknock writes the stored password to Docker’s standard input and closes the stream. It does not add that delivered value to Docker’s environment. A successful login reports:

Login Succeeded

Docker saves login credentials in its configured credential store or Docker configuration, so this action establishes access that can outlast the command. Agentknock controls delivery to Docker; Docker’s credential settings control subsequent storage.

Keep the surrounding environment in mind

Commands inherit the environment of the shell that starts Agentknock. These delivery options do not clear variables already present there. If your shell already exports PGPASSWORD, renaming the phone’s value to FLYWAY_PASSWORD leaves that inherited PGPASSWORD intact. Clear obsolete exports when moving an existing workflow to phone-held credentials.

For combinations involving several secrets, omitted variables, or conflicting names, see environment delivery options. The same phone review applies regardless of how the command receives its requested value.