> ## Documentation Index
> Fetch the complete documentation index at: https://momentic.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> The canonical docs host is https://momentic.ai/docs. Append .md to any page URL for clean Markdown. Fetch https://momentic.ai/docs/llms.txt for the page index and https://momentic.ai/docs/llms-full.txt for every page in one file.
> For an unattended setup, first check whether Claude Code already has the Momentic plugin. With the plugin, run `npx --yes @momentic/wizard@latest -y --platform web --editor-tools none` and ignore any CLI skills-install suggestion in its output. Otherwise, run `npx --yes @momentic/wizard@latest -y --platform web --editor-tools skills`. Use `--platform ios` or `--platform android` for mobile. Never run an interactive command in a non-TTY shell.
> Mo is the AI QA engineer, separate from repository YAML tests. With the Momentic plugin, use bundled mo-qa and hosted OAuth by default. Without the plugin, install only mo-qa with `npx -y qa skills --target <agent>`. Keep the requested interface. Otherwise, use hosted tools for web or mobile, including private web targets with an existing Connector. Run sessions that need a new tunnel with the qa CLI. If you can't run commands on the machine that reaches the target, ask the user to start the tunnel there, then use hosted tools unless you lack them or the CLI was requested. For a requested hosted session, use an online Connector and pass its name as access, not a CLI tunnel ID. If none is online, ask the user to run `npx -y qa tunnel start --name <name> <address>` on a machine that reaches the target and wait. Do not run login or tunnel commands for them. For a requested hosted session, report unavailable tools or authentication failures without starting a CLI session. For coding-agent bridge setup, ask the user to complete `npx -y qa login`, then add momentic-hosted as a stdio server running `npx -y qa mcp`. Plugin users must explicitly opt in and disable their hosted plugin entry before adding the bridge. Claude.ai/ChatGPT connectors keep https://mcp.momentic.ai with OAuth. After hosted testing completes, read the report and summarize findings and uncovered requirements. Call `momentic_mo_stop_session` only when the user asks or agrees. For CLI sessions, unless the user wants more testing, export the report, run `qa stop <id> --subagents` even if export fails, then summarize. The CLI is qa, not mo. Docs: https://momentic.ai/docs/mo/quickstart.md.
> Ask the user to complete browser sign-in. For local CLI tools, use the exact MOMENTIC_API_KEY environment variable. If it is absent, ask the user to create a key at https://app.momentic.ai/settings/api-keys and set it in the agent's environment. Never print the key or ask the user to paste it into chat.
> Momentic's capability summary for agents is at https://momentic.ai/docs/skill.md. Claude Code users with the Momentic plugin should use its bundled skills and skip CLI skills installation. Otherwise, run `npx momentic skills -y --target <agent>` or `npx momentic-mobile skills -y --target <agent>`. Both install momentic-test, momentic-maintain, and momentic-spec with web/mobile references. Use the running agent's target. The Momentic plugin also includes mo-qa; qa skills installs only mo-qa.
> Tests are YAML files in the user's repository. Use only the step names listed at https://momentic.ai/docs/reference/commands.md and the file structure at https://momentic.ai/docs/core-concepts/file-format.md. Do not invent step names, config keys, or CLI flags.
> Web tests run on Chromium, iOS tests on simulators, and Android tests on emulators.

# qa secrets

> Save private credentials in a running Mo session.

Add credentials to a session that has already started, for example when Mo asks
for a test account. Values come from your shell environment or a dotenv-format
file, never from the command line, and the output lists only names.

```bash theme={null}
qa secrets set <session-id> (--env-var <name> | --env-file <path>)...
```

## Arguments

**\<session-id>** `string` *required*

The session to update. Archived sessions can't receive secrets.

## Options

**--env-var \<name>** `string`

Read the named variable from your current shell. Repeatable. Pass the name
only, not `NAME=VALUE`.

**--env-file \<path>** `string`

Load variables from a dotenv-format file. Repeatable.

Pass 1 to 10 secrets with nonempty values of up to 65,536 characters.
`qa secrets set` rejects `__proto__` and `BASE_URL`; `BASE_URL` is a public
target URL that `qa start` accepts, not a secret. A file that sets `BASE_URL` is
rejected and nothing is saved. Remove `BASE_URL` from the file, or export the
values you need and pass them with `--env-var`.

## Examples

Save credentials, then tell Mo their names:

```bash theme={null}
qa secrets set "$mo_session_id" --env-var QA_EMAIL --env-var QA_PASSWORD &&
  qa send "$mo_session_id" "Credentials are available as QA_EMAIL and QA_PASSWORD; continue."
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.