Personal toolkit: your time zone and your own signing key

Personal toolkit is a small tool server that works with settings only you hold: your time zone, the locale you like dates written in, and a signing key of your own. You set them once on the console’s My variables page. From then on you can ask the chat workspace things like “what time is it for me?” or “sign this text with my key”, and the answer uses your settings, not anybody else’s.

This guide is for everyone, not only administrators. It was checked end to end on the running product on 27 September 2026. A person set all three values, asked the chat for the time and for a signature over hello, and got their own zone and their own signature. The audit trail recorded the three variable names and none of the values.

What you need

• Your normal sign-in to the console and to the chat workspace (aimo).
• Personal toolkit enabled for you. It appears on My variables as Personal toolkit envkit. If you cannot see it, ask your administrator to make it available to your team.
• For the signing part only: a terminal on macOS or Linux, or PowerShell on Windows, if you want to check a signature on your own computer.

How it works, in one paragraph

Your values are stored encrypted and are sent only on your calls to this one tool server. The server starts a separate process for you, with your values and nobody else’s, and stops it after ten minutes without calls. The model sees the tool’s answers (the time, a signature), never your signing key. Administrators can see how many people have set a variable, but never a value.

Step 1: open My variables

Sign in to the console and open My variables (/vault). Find the Personal toolkit section. It lists three variables, all optional:

Type a value, press Save, and the row switches to set with a short fingerprint. To change a value later, type the new one and press Replace. To delete it, press Remove.

Never paste a key into a chat instead. Anything typed into a chat goes to the model and into the audit trail. Values saved on My variables do neither.

Step 2: set your time zone and locale

1. In MY_TIMEZONE, enter your zone’s IANA name, the Region/City form used by every operating system, for example Europe/Istanbul. The list of time zone names has them all. A short form like GMT+3 or TRT is not an IANA name and will not work.
2. In MY_LOCALE, enter a language tag such as tr-TR (Turkish dates) or en-GB (British English). If you leave it empty, dates are written in en-GB.
3. Press Save on each.

Step 3: turn the tool on in a chat and check it

Open a new chat in the workspace, enable Personal toolkit in the chat’s tools, and ask:

Which of my settings reached the personal toolkit?

The answer comes from the my_settings tool and reads like this:

Your variables on this tool server:
- MY_TIMEZONE: set to "Europe/Istanbul" — the time zone my_time answers in
- MY_LOCALE: set to "tr-TR" — how my_time writes dates
- MY_SIGNING_KEY: set (secret — value not shown) — the key sign_text and verify_signature use

A variable you have not set says not set. One you set to something unusable says so as well: for example, a zone that is not a valid IANA name is reported and replaced by UTC.

Using your time zone

You never have to tell the chat where you are: the tool reads your zone from My variables. Ask, for example:

• What time is it for me?
• What is 2026-10-01 09:00 UTC in my time zone, and in New York?
• When it is 12:00 for me on 1 October, what time is it in Tokyo?

With MY_TIMEZONE = Europe/Istanbul and MY_LOCALE = tr-TR, the second question comes back as:

1 Ekim 2026 Perşembe 12:00:00 GMT+3 (Europe/Istanbul)
1 Ekim 2026 Perşembe 05:00:00 GMT-4 (America/New_York)

The same instant with MY_LOCALE = en-GB:

Thursday, 1 October 2026 at 12:00:00 GMT+3 (Europe/Istanbul)
Thursday, 1 October 2026 at 05:00:00 GMT-4 (America/New_York)

If you have not set a zone, the tool answers in UTC and says so, for example Thursday, 1 October 2026 at 09:00:00 UTC (UTC) followed by a line pointing you to My variables.

Signing text with your own key

What an HMAC-SHA256 signature is for

An HMAC-SHA256 is a short code computed from a piece of text and a secret key. Anyone who holds the same key can recompute it and check that the text is exactly what was signed, down to the last space. It is how many webhooks and APIs prove that a message came from someone who knows the key and was not changed on the way.

Two things to keep in mind:

• It is a shared-secret signature, not a public one. Whoever you share the key with can also create valid signatures. Share it only with the system that needs to check them.
• The key is used exactly as you typed it, as text. A key made of hexadecimal characters is not decoded first; the characters themselves are the key.

1. Create a key on your own computer

Make a long random key. Any of these prints 64 random hexadecimal characters.

macOS and Linux (Terminal):

openssl rand -hex 32

Windows (PowerShell, both Windows PowerShell 5.1 and PowerShell 7):

$bytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
-join ($bytes | ForEach-Object { $_.ToString('x2') })

Copy the output. Keep a copy wherever the other side, the system that will check your signatures, needs it, for example your password manager.

2. Save it as MY_SIGNING_KEY

On My variables, paste it into MY_SIGNING_KEY under Personal toolkit and press Save. The value is never shown again, not even to you; the fingerprint tells you that a key is set.

3. Sign “hello” in the chat

Ask the chat:

Sign the text “hello” with my key.

The sign_text tool answers with the signature and nothing else:

HMAC-SHA256 (hex): <64 hexadecimal characters>
Signed 5 bytes with your MY_SIGNING_KEY.

5 bytes is the length of hello. If the model added a space or a line break, the byte count shows it. Ask for base64 instead of hex if the receiving system expects that.

4. Check the signature on your own computer

Recompute the same signature locally with your key. If the two match, the chat signed exactly hello with exactly your key.

macOS and Linux:

KEY='paste-your-key-here'
printf '%s' 'hello' | openssl dgst -sha256 -hmac "$KEY" | awk '{print $NF}'

Windows (PowerShell):

$key  = 'paste-your-key-here'
$text = 'hello'
$hmac = New-Object System.Security.Cryptography.HMACSHA256 (,[System.Text.Encoding]::UTF8.GetBytes($key))
-join ($hmac.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($text)) | ForEach-Object { $_.ToString('x2') })

Any system with Python 3:

python3 -c 'import hmac,hashlib,sys; print(hmac.new(sys.argv[1].encode(), b"hello", hashlib.sha256).hexdigest())' 'paste-your-key-here'

For base64 on macOS or Linux, add -binary and pipe it through base64: printf '%s' 'hello' | openssl dgst -sha256 -hmac "$KEY" -binary | base64. In PowerShell, use [Convert]::ToBase64String(...) on the computed hash.

Try your command on a known answer first. Before using your real key, run the command with this example key, which is for testing only:

The same example in base64:

LH3IffbcTswQpHyEECZGMCg4dtGD8lOx+5WqH1adaCA=

All three commands above produce exactly these values: they were run on macOS (OpenSSL 3 and the built-in LibreSSL), with Python 3, and in PowerShell 7, and each matched the toolkit’s own result.

The most common mistake is echo. echo hello sends hello followed by a line break, which is six bytes, not five, and gives a completely different signature (d85119b6… for the example key). Use printf '%s' as shown, or echo -n where your shell supports it.

5. Verify a signature in the chat

You can also ask the tool to check a signature for you:

Verify that <signature> is my signature over “hello”.

The verify_signature tool answers Valid: this is your signature over exactly that text. or NOT valid: the signature does not match that text under your key. It accepts hex or base64 and compares in constant time.

Changing or removing a value

• Replace or Remove on My variables takes effect on your next tool call. The server starts a fresh process with the new values. You do not need a new chat.
• Removing MY_SIGNING_KEY makes sign_text answer MY_SIGNING_KEY is not set with a pointer back to My variables. Signatures you made earlier stay valid for anyone who still holds that key.
• If a key may have leaked, replace it here and everywhere you shared it, since whoever holds the old key can still create signatures that match it.

When something is not right

What stays private

• Your key never reaches the model. Only the signature does. If a tool answer ever contained a secret value, it would be replaced by [uservar:MY_SIGNING_KEY] before leaving the server.
• Your own process. Your values are loaded into a process started for you alone and discarded when it stops. Two people never share one.
• Names, not values, in the audit trail. Each call records which of your variables were used, by name. Your time zone is not secret, but even the stored copy of the answer masks it.
• Nobody else reads your values. Administrators see only how many people have set a variable; they can delete a person’s values when someone leaves, but never read them.

The walkthrough at the top of this page shows how a value travels from My variables to a tool, and the GitHub article shows the same vault used with a third-party service.