API keys from environment variables

[inigohidalgo]

Hello! Loving roocode, it's a pleasure to use it every time.

I had a small QoL feature request: loading API keys from environment variables/secrets manager.

Would be nice for dev environments like devcontainers which might rotate API keys frequently.

e.g. ROO_ANTHROPIC_API_KEY, ROO_OPENAI_API_KEY etc.

Thanks for the extension!!

[ahmedeljoker2025]

I always face this problem, do you have a solution?

[kdmgs110]

As I use Roo code on Github Code Spaces, and setting environment variable through Github Secrets and Variables,
I really want this feature request to be realized. (Otherwise I need to set environment variable manually every time I launch Github Code Spaces instance, and needed to share environment variables to team member that will have potential risk of exposing api key to the public.)

[suprjinx]

I started working up an implementation for this main...suprjinx:Roo-Code:add_api_key_env_vars

[suprjinx]

@hannesrudolph his discussion is where PR #3032 originated. I think an EnvVar source for api tokens could be helpful for a lot of token rotation/storage stories, eg #3610

[hannesrudolph]

Making it easier to circumvent limits on free accounts is outside of what we want to implement in Roo.

[inigohidalgo]

@hannesrudolph I'm surprised you thought of circumventing limits on free accounts, where did you get that idea from?

My request is because as part of working with @devcontainers, we get a fresh environment each time we start them up. Part of creating this environment involves supplying necessary account keys, secrets, etc into the environment. We do this for configuring auth for our cloud storage for example.

All I was asking for was a way to supply these keys to Roo code without needing to manually copy and paste the keys into the Roo dialog each time we refresh them in the Anthropic or Gemini dashboards for security/rotation purposes. Leveraging this we'd be able to generate tokens per user or even per model to allow specific credential management.

[suprjinx]

@hannesrudolph to amplify what @inigohidalgo wrote, i think in many organizational settings, an end user is not intended to know and handle secrets.

[suprjinx]

detailed feature request #4337

[e111077]

FWIW, at our company we have rotating IAP keys that are generated with a CLI command. It would be great to be able to allow a CLI hook as well to generate the keys which is a feature Claude Code has for enterprise users

[suprjinx]

@NamesMT made a good work-around suggestion in the feature request -- you can put a value like ${env:ANTHROPIC_API_KEY} in the API key field and it will read that when you start your chat session. Just make sure you've got the incantation just right (perhaps in an editor tab) since API key is a secret field.

EDIT: I don't think it will automatically expand env placeholders without code changes to incorporate injectEnv, so this isn't really a work around but a different approach.