Keep API keys and tokens out of agent conversations and hand each command only the secrets it needs.
Use whenever a command, script or MCP server needs an API key, token or password, when one fails with 401/403 or "missing key", when the user pastes or mentions a token, asks where their keys are, wants to add, rotate or remove one, or when a plugin's keyfob.json is being written. keyfob keeps values in the OS keystore (or a 0600 file on servers) and hands them to one command at a time without exposing them to the agent.
