Keep secrets out of the config file

Reference a secret from mistral-native.json without storing it there — for example, a gateway URL or agent id provisioned by a secret manager. You need this when the value is secret or machine-specific.

Prerequisites

• The pi-mistral-native package installed
• The secret available as an environment variable, or printable by a shell command

1. Store the secret outside the config file — a secret manager, an environment file your shell sources, or auth.json for the API key.

2. Reference it from the config value. agentId and endpoint.baseUrl support the config-value protocol:

   {
     "agentId": "$MISTRAL_AGENT",
     "endpoint": { "baseUrl": "!pass show mistral/gateway-url" }
   }

   • $VAR / ${VAR} — interpolate an environment variable
   • !command — run a shell command (10s timeout); the trimmed stdout is the value
   • $$ and $! — literal $ and !

3. Verify the effective value:

   /mistral

   The status card shows the raw stored string (never the resolved value). A referenced-but-unset variable, or a failing command, resolves the whole value to unset — never an error, never logged; the key falls through to lower layers.

A !command value runs a shell command

Every session start executes it. Only reference commands you control — the same caution as any credential-resolving command.

The API key never goes into the config file

mistral-native.json has no key field. The API key lives in pi’s credential storage or the environment — see Set up your API key.

See Configuration keys · Credential chain