---
title: An SG/Send access token as an environment secret
summary: Put an SG/Send access token in the agents' environment as a secret (never in chat).
---
# An SG/Send access token as an environment secret

> Kept by incident.board@web-summit.dinis, 11 November 2026, 04:31 UTC

**ask** · state: **open** (nobody has closed it and nothing is known to stand in the way) · waiting on **Dinis** · owner: [incident.conductor@](../../agents/index.html?who=incident.conductor%40web-summit.dinis) · raised by [incident.conductor@](../../agents/index.html?who=incident.conductor%40web-summit.dinis), [incident.identity@](../../agents/index.html?who=incident.identity%40web-summit.dinis) · opened 2026-11-11 01:03 UTC · card `a-sgsend-token` on [the board](../index.md#a-sgsend-token)

Put an SG/Send access token in the agents' environment as a secret (never in chat).

## What it blocks

As the asking agents put it: the feedback lane from you to the conductor, your own vaults and the page-view vault need it. (Two agents have since made vaults with sgit for captures and a data set, so vaults as such are not blocked: see a-vault-keys-handover.)

Cards behind this one:

- [incident.identity@: when a token is in the environment and he says yes: the bridge vault (sgit), then SG_SEND_TOKEN and LANE_VAULT_KEY…](../items/j-identity-2.md) · job · **blocked** · waiting on Dinis · incident.identity@

## What would close it

The token is present in the environment (an agent confirms it without printing it), and you have said which sessions get it.


## Evidence (2)

- file [SECURITY.md](../../SECURITY.html)
- file [RESTRUCTURE.md](../../RESTRUCTURE.html)

## Connected cards

- [Three decisions on your login and the feedback lane (SECURITY.md)](../items/a-identity-decisions.md) · ask · **open** · waiting on Dinis · incident.identity@
- [Page views: whose key are the events sealed to? (the vault is answered: it exists)](../items/a-pageviews-vault.md) · ask · **done** · waiting on Dinis · incident.observability@
- [Two vault write keys are still held only in incident.archivist@'s session](../items/a-vault-keys-handover.md) · ask · **open** · waiting on Dinis · incident.conductor@

## Where the card came from

- [agents/identity/status.json](../../agents/identity/status.json) (asks): "Dinis: your yes to create the lane and the two vaults (bridge, data) o…"

## History

- 2026-11-11 02:20 UTC · incident.board@: card opened from the agents' status files (every "Dinis:" ask, the same ask from several agents joined in one card)
- 2026-11-11 02:31 UTC · incident.board@: corrected: the card said no vault could be made without the token; that was the board's own inference and it was wrong (incident.archivist@ and incident.sources@ made three vaults with sgit, read in their status files). The card now says only what the asking agents say needs the token
- 2026-11-11 02:28 UTC · incident.board@: re-ranked 10 of 26 for Dinis: the list is now sorted by what stands before the launch first, at incident.conductor@'s direction (02:24 UTC)
- 2026-11-11 04:31 UTC · incident.board@: no longer listed in agents/conductor/status.json; still listed in agents/identity/status.json

The card as data: [a-sgsend-token.json](a-sgsend-token.json). Not a warning service.