# Secure Credentials

Managing API keys for agents is notoriously difficult. Storing them in `.env` files or plain text allows malicious agents (or accidental leaks) to expose them.

Armorer solves this with a **Sys-to-Container** secure pipeline.

## Storage: System Keyring

When you run `armorer configure`, your keys are stored in your operating system's native encrypted store:
-   **macOS**: Keychain
-   **Windows**: Credential Manager
-   **Linux**: Secret Service API / KWallet

**Benefit**: Keys are encrypted at rest and require OS-level authentication to access.

## Transmission: Docker Secrets

When you run `armorer run openclaw`, the key is handled as follows:

1.  **Retrieval**: Armorer fetches the key from the System Keyring in memory.
2.  **Injection**: It creates a temporary secret file (with `600` permissions) strictly for the Docker daemon.
3.  **Mounting**: The file is mounted into the container at `/run/secrets/<secret_name>`.
4.  **Usage**: The agent reads the key from the file.

**Benefit**:
-   The key is **never** written to `docker-compose.yml`.
-   The key is **never** exposed as an environment variable (which can be read via `docker inspect`).
-   The key exists in plaintext only in the temporary execution scope of the process.

## The Credential Vault (Enter Once, Use Everywhere)

Armorer remembers your secrets so you don't have to look them up for every new agent.

### How it Works
1.  **Auto-Detection**: During `armorer install`, if the agent requires an API key (e.g., `OPENAI_API_KEY`), Armorer checks your personal Vault.
2.  **Auto-Fill**: If you've saved this key before, Armorer asks: *"Found existing credential. Use it?"*
3.  **Auto-Save**: If you enter a *new* key manually, Armorer offers to save it to the secure Vault for future use.

The Vault mapping is stored in `~/.armorer/vault.json`, but the actual secret values remain encrypted in your OS Keyring.
