# Secrets

> Tag 10: the client feeds the container the values of its secrets, each by name, before the agent’s next loop; the server opens a secrets channel on the container’s begin scope with the values verbatim and relays exactly one channel response, fed or the container’s refusal, and the channel response finish.

Canonical: https://protocol.diverge.network/2.3.0/endpoints/containers-agents-run/client/secrets/
Specification revision: 2.3.0

The client opens this channel to hand the container the values of
the secrets its program declared, one value under every name, before
the container is next delivered a message. The server opens a
[secrets](/2.3.0/container-proxy-endpoints/agents-begin/client/secrets/)
channel on the begin scope of the container's proxy with the values
and relays the answer the proxy gives. Until the proxy has answered
`Fed`, the proxy delivers no message to a program that declared a
secret, as the [begin response](/2.3.0/container-proxy-endpoints/agents-begin/response/)
states; a message enqueued meanwhile waits.

- **The request.** The tag byte `10` followed by the values as JSON.
  [Request](/2.3.0/endpoints/containers-agents-run/client/secrets/request/) states its form.
- **The response.** Exactly one channel response, relayed as the
  proxy sent it, and the channel response finish.
  [Response](/2.3.0/endpoints/containers-agents-run/client/secrets/response/)
  states the sequence.
- **When.** The first values of a run are not fed on this channel: the
  server feeds them itself, from the answer to the
  [registration](/2.3.0/endpoints/containers-agents-run/server/registration/)
  channel, before it sends the id. After every `Inactive` of the main
  stream the container holds no values, and the client feeds them
  again on this channel before the next loop.
- **Verbatim.** The server relays the values as the client sent them
  and reads none of them. A value is read by nothing between the
  client and the container's program.