From 08ca6e2aaf4b7aa2a292e2cee34ba234f45af0b8 Mon Sep 17 00:00:00 2001 From: Eric Fortney Date: Wed, 9 Sep 2026 21:24:12 -0700 Subject: [PATCH] Stop telling agents to ask for the user's Sandbox secret All three guides opened by instructing the agent to ask the developer for their client_id and secret when not provided. An agent following that puts a live credential into a model's context and into the transcript. The Plaid CLI can fetch them from the Dashboard and write the .env itself, so the guides now point at `plaid keys write --env sandbox` and say plainly not to ask for a secret in chat. The Prerequisites line is updated the same way, since it assumed the credentials had been copied by hand. --- rules/signal_guide.md | 7 +++++-- rules/transactions_guide.md | 7 +++++-- rules/transfer_guide.md | 7 +++++-- 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/rules/signal_guide.md b/rules/signal_guide.md index 0cd7def..20e1ab6 100644 --- a/rules/signal_guide.md +++ b/rules/signal_guide.md @@ -12,7 +12,10 @@ This guide provides a complete, step-by-step integration of Plaid Signal using t This guide applies to both. If you only need a pre-payment balance check today, integrate `/signal/evaluate` with a Balance-only ruleset now; you can upgrade to Signal Transaction Scores later via a Dashboard configuration change, with no re-integration. **If you are building a pay-by-bank or account-funding flow and need to add ACH return mitigation, this is the recommended path. Do not use `/accounts/balance/get` for payment risk checks** — that endpoint is for non-payment use cases such as personal financial management or treasury, and it does not evaluate risk against Signal Rules. Assumptions: -- The developer has a Plaid account and Sandbox `client_id` and `secret` are available. If not provided, please ask the users for it. +- The developer has a Plaid account and Sandbox credentials configured in `.env`. If not, run + `plaid keys write --env sandbox` ([Plaid CLI](https://plaid.com/docs/resources/cli/)), which fetches + them from the Dashboard and writes the file. Never ask the user to paste a `client_id` or `secret` + into chat. - The application is able to make HTTP requests. - You have access to Signal. The Balance-only tier is available to Balance customers; the Signal Transaction Scores tier requires separate approval (you can use Sandbox while waiting for approval). @@ -26,7 +29,7 @@ This guide is designed to be used for the purpose of building a sample Plaid int Before starting the integration, ensure the following: - You have a [Plaid Developer Dashboard](https://dashboard.plaid.com) account. -- You have obtained your **client ID** and **Sandbox secret** from the dashboard. +- Your Sandbox **client ID** and **secret** are in `.env`, written by `plaid keys write --env sandbox`. - You are working in the [Sandbox environment](https://plaid.com/docs/sandbox/) where test credentials and institutions are available. - Your development environment can serve both **frontend** and **backend** logic. The backend must be able to securely manage sensitive credentials and handle API calls. - You have access to Signal. The Balance-only tier is available to Balance customers; the Signal Transaction Scores tier requires separate approval (you can use Sandbox while waiting for approval). diff --git a/rules/transactions_guide.md b/rules/transactions_guide.md index d6dde41..ea17a57 100644 --- a/rules/transactions_guide.md +++ b/rules/transactions_guide.md @@ -6,7 +6,10 @@ This guide provides a complete, step-by-step integration of Plaid's **Transactio Assumptions: -- The developer has a Plaid account and Sandbox `client_id` and `secret` are available. If not provided, please ask the users for it. +- The developer has a Plaid account and Sandbox credentials configured in `.env`. If not, run + `plaid keys write --env sandbox` ([Plaid CLI](https://plaid.com/docs/resources/cli/)), which fetches + them from the Dashboard and writes the file. Never ask the user to paste a `client_id` or `secret` + into chat. - The application is able to make HTTP requests. This document references Plaid's official documentation using markdown links. @@ -17,7 +20,7 @@ This guide is designed to be used for the purpose of building a sample Plaid int ## Prerequisites Before starting the integration, check with the user and make sure: -- You have obtained your **client ID** and **Sandbox secret** from the dashboard. +- Your Sandbox **client ID** and **secret** are in `.env`, written by `plaid keys write --env sandbox`. - Your development environment can serve both **frontend** and **backend** logic. The backend must be able to securely manage sensitive credentials and handle API calls. ## Step 1: Backend - Create a Link Token diff --git a/rules/transfer_guide.md b/rules/transfer_guide.md index 662bacf..aa0bc76 100644 --- a/rules/transfer_guide.md +++ b/rules/transfer_guide.md @@ -6,7 +6,10 @@ This guide provides a complete, step-by-step integration of Plaid's **Transfer** Assumptions: -- The developer has a Plaid account and Sandbox `client_id` and `secret` are available. If not provided, please ask the users for it. +- The developer has a Plaid account and Sandbox credentials configured in `.env`. If not, run + `plaid keys write --env sandbox` ([Plaid CLI](https://plaid.com/docs/resources/cli/)), which fetches + them from the Dashboard and writes the file. Never ask the user to paste a `client_id` or `secret` + into chat. - The application is able to make HTTP requests. This document references Plaid's official documentation using markdown links. @@ -25,7 +28,7 @@ Follow the appropriate respective guide. ## Prerequisites - You have a [Plaid Developer Dashboard](https://dashboard.plaid.com) account. -- You have obtained your **client ID** and **Sandbox secret** from the dashboard. +- Your Sandbox **client ID** and **secret** are in `.env`, written by `plaid keys write --env sandbox`. - You are working in the [Sandbox environment](https://plaid.com/docs/sandbox/) where test credentials and institutions are available. - Your development environment can serve both **frontend** and **backend** logic. The backend must be able to securely manage sensitive credentials and handle API calls.