# Secrets

> Tag 4: the client hands the container the values of its secrets, each by name; the server hands them to the container’s program, holds the channel until the program holds them, and answers with exactly one channel response, fed or the program’s refusal, and the channel response finish; a Fed is what lets the server deliver the next message.

Canonical: https://protocol.diverge.network/2.3.0/container-proxy-endpoints/agents-begin/client/secrets/
Specification revision: 2.3.0

The client opens this channel to hand the container the values of
the secrets its program declared at its registration, one value under
every name. The server hands the values to the container's program
and answers only when the program holds them.

- **The request.** The tag byte `4` followed by the values as JSON.
  [Request](/2.3.0/container-proxy-endpoints/agents-begin/client/secrets/request/) states its form.
- **The response.** Exactly one channel response, fed or an error,
  and the channel response finish.
  [Response](/2.3.0/container-proxy-endpoints/agents-begin/client/secrets/response/) states the sequence.
- **The feed.** The server hands the values to the container's
  program before it answers, and answers the byte `0` only once the
  program has taken them. A program that refuses the values is
  answered by the byte `1` followed by the program's own words, and
  holds no values.
- **The gate.** After `Begun`, and after every `Inactive` of the main
  stream, the server delivers no message to a program that declared
  one or more secrets until a channel of this section has been
  answered `Fed`: a message enqueued meanwhile waits, and no loop
  starts on it. The byte `0` opens the gate; the byte `1` leaves it
  closed. A program that declared no secret is never held: the server
  delivers to it from `Begun` and from every `Inactive`.
- **When.** The client opens this channel once before the run's id is
  sent, with the values the registration was answered with, and
  again before every loop after an `Inactive`. The server holds the
  channel open, however long the program takes, and imposes no
  timeout.
- **Verbatim.** The server hands the values to the program as the
  client sent them and reads none of them.