Add instructions to securely manage token

docs/guides/functions.ipynb

@@ -73,7 +73,7 @@
    "id": "42843fcd-1779-4a74-8d6a-7d00c22e374e",
    "metadata": {},
    "source": [
-    "Optionally, you can use the `save_account()` method to save your credentials for easy access later on, before initializing the service. This saves your credentials in the same place as `QiskitRuntimeService.save_account()`, so you can skip this step if you had previously used `QiskitRuntimeService` to save your account. *Note that account credentials are saved in plain text, so only do so if you are using a trusted device.*"
+    "Optionally, you can use the `save_account()` method to save your credentials for easy access later on, before initializing the service. This saves your credentials in the same place as `QiskitRuntimeService.save_account()`, so you can skip this step if you had previously used `QiskitRuntimeService` to save your account. *Note that account credentials are saved in plain text. To more securely manage your token, it is recommended that you use an environment variable; see the [Securely manage your token](/guides/setup-channel#securely-manage) section for more information.*"
    ]
   },
   {

docs/guides/setup-channel.mdx

@@ -23,7 +23,6 @@ Available plans:
 
 * **Premium Plan** - Run quantum circuits on the world's best QPUs using an enterprise quantum time subscription.
 
-
 ### IBM Cloud
 
 IBM Cloud offers pay-as-you-go access plans. See [IBM Quantum access plans](https://www.ibm.com/quantum/access-plans) for details.
@@ -60,7 +59,7 @@ Available plans:
 
    ```
 
-   Or, optionally use the `save_account()` method to save your credentials for easy access later on, before initializing the service.
+   Or, optionally use the `save_account()` method to save your credentials for easy access later on, before initializing the service. *Note that account credentials are saved in plain text. To more securely manage your token, it is recommended that you use an environment variable; see the [Securely manage your token](#securely-manage) section for more information.*
 
     ```python
     from qiskit_ibm_runtime import QiskitRuntimeService
@@ -85,20 +84,13 @@ Available plans:
     * The `channel` parameter allows you to distinguish between different account types. When initializing the account, IBM Cloud is the default account used if have saved credentials for an IBM Quantum Platform and an IBM Cloud account.
 
     <Admonition type="caution">
-      Account credentials are saved in plain text, so only do so if you are using a trusted device.
+      Account credentials are saved in plain text. To more securely manage your token, it is recommended that you use an environment variable; see the [Securely manage your token](#securely-manage) section for more information.
     </Admonition>
 
     <Admonition type="note">
     IBM Cloud is the default account used if you don't specify a different channel or account name.
     </Admonition>
 
-    <CodeAssistantAdmonition
-      tagLine="If you forget the setup code, try asking Qiskit Code Assistant."
-      prompts={[
-        "# Set up my IBM Runtime account using TOKEN for my token"
-      ]}
-    />
-
 1. Test your setup.  Run a simple circuit using Sampler to ensure that your environment is set up properly:
 
   ```python
@@ -205,16 +197,15 @@ Alternatively, you can also access quantum processors with REST APIs, enabling y
     1. Find your API key. From the [API keys page](https://cloud.ibm.com/iam/apikeys), view or create your API key, then copy it to a secure location so you can use it for authentication.
     2. Find your Cloud Resource Name (CRN). Open the [Instances page](https://cloud.ibm.com/quantum/instances) and click your instance. In the page that opens, click the icon to copy your CRN. Save it in a secure location so you can use it for authentication.
 
-<span id="cloud-save"></span>
-1. Authenticate to the service by calling `QiskitRuntimeService` with your saved credentials or with your IBM Cloud API key and CRN:
+1. <span id="cloud-save"></span>Authenticate to the service by calling `QiskitRuntimeService` with your saved credentials or with your IBM Cloud API key and CRN:
 
    ```python
    from qiskit_ibm_runtime import QiskitRuntimeService
 
    service = QiskitRuntimeService(channel="ibm_cloud", token="<IBM Cloud API key>", instance="<IBM Cloud CRN>")
    ```
 
-   You can optionally use the `save_account()` method to save your credentials for easy access later on, before initializing the service.
+   You can optionally use the `save_account()` method to save your credentials for easy access later on, before initializing the service. *Note that account credentials are saved in plain text. To more securely manage your token, it is recommended that you use an environment variable; see the [Securely manage your token](#securely-manage) section for more information.* 
 
    ```python
     from qiskit_ibm_runtime import QiskitRuntimeService
@@ -238,17 +229,66 @@ Alternatively, you can also access quantum processors with REST APIs, enabling y
     * Credentials are saved to `$HOME/.qiskit/qiskit-ibm.json`.  Do not manually edit this file.
     * If you don't save your credentials, you must specify them every time you start a new session.
 
+
     <Admonition type="caution">
-        Account credentials are saved in plain text, so only do so if you are using a trusted device.
+      Account credentials are saved in plain text. To more securely manage your token, it is recommended that you use an environment variable; see the [Securely manage your token](#securely-manage) section for more information.
     </Admonition>
 
- 1. Test your setup.  Ensure that you can connect to the service:
+6. Test your setup.  Ensure that you can connect to the service:
 
-   ```python
-    from qiskit_ibm_runtime import QiskitRuntimeService
+```python
+  from qiskit_ibm_runtime import QiskitRuntimeService
 
-    service = QiskitRuntimeService()
+  service = QiskitRuntimeService()
+```
+
+<span id="securely-manage"></span>
+## Securely manage your token
+
+To store sensitive information like account credentials more securely, it’s a good practice to use environment variables instead of saving them in plain text. The following demonstrates how to modify your code to load the API token from an environment variable.
+
+1. Set the environment variable.
+
+Set the `IQP_API_TOKEN` environment variable in your system. You can do this by adding the following line to your shell profile (for example, `.bashrc`, `.zshrc`) or by setting it directly in your terminal:
+
+```bash
+export IQP_API_TOKEN="<YOUR_IQP_API_TOKEN>"
+```
+
+2. Modify the code to retrieve the token from the environment variable.
+
+Update your code to retrieve the token from the environment variable instead of saving it directly:
+
+<Tabs>
+
+  <TabItem value="runtime" label="Within Qiskit Runtime">
+  ```python
+  import os
+  from qiskit_ibm_runtime import QiskitRuntimeService
+
+  # Gather the token from your environment variables.
+  # We use `.pop()` to ensure any subprocesses started by
+  # our program cannot access the value.
+  iqp_api_token = os.environ.pop("IQP_API_TOKEN")
+
+  QiskitRuntimeService.save_account(token=iqp_api_token)
+  ```
+  </TabItem>
+
+  <TabItem value="functions" label="Within Qiskit Functions">
+  ```python
+  import os
+  from qiskit_ibm_catalog import QiskitFunctionsCatalog
+
+  # Gather the token from your environment variables.
+  # We use `.pop()` to ensure any subprocesses started by
+  # our program cannot access the value.
+  iqp_api_token = os.environ.pop("IQP_API_TOKEN")
+
+  QiskitFunctionsCatalog.save_account(token=iqp_api_token)
   ```
+  </TabItem>
+</Tabs>
 
 ## Next steps