Keystores and secrets

What a Keystore does

A Keystore is an Environment-scoped resource for credentials such as API keys, passwords, or tokens. Settings can refer to a stored value so you can configure an integration without putting the credential into an ordinary Assistant message.

A store has a display name and a stable alias. The alias identifies it in references. A key alias identifies a secret within that store. The same store alias can exist in different Environments and resolve to different stores and credentials.

Two store types

For Beta 1, use an ELYXIS store. Your administrator must populate it and grant the required access; creating a store resource does not automatically add an API key.

Use a stored secret during setup

When the CLI asks for a Setting entry value and offers a stored-value choice:

1. Enter /store.
2. Choose the Keystore in the selected Environment.
3. Choose a listed key alias from the Elyxis store.
4. Review and confirm the proposed Setting update.

The CLI creates a reference in this form:

${store-alias:key-alias}

For example, a store alias team-secrets and key alias model-api-key produce:

${team-secrets:model-api-key}

This is a reference, not the API key itself. Select it through /store so the Setting records it as KEYSTORE_ALIAS. Do not replace the key alias with the raw secret value.

When a secret cannot be found

Confirm the Environment, store alias, key alias, and access with your administrator. An empty Elyxis store has no keys for the picker to show. External managed stores are not supported yet.

You can ask the Assistant:

List the keystores and explain what is missing for the model configuration. Do not show secret values.

Store inspection returns safe metadata and schema-redacted provider configuration. A listed store alone does not prove that a capability can resolve its credential.

Handle credentials privately

Use your team's approved secret-entry process to add or rotate a credential. Keep raw keys out of ordinary prompts, examples, screenshots, and support attachments. Your CLI login file is a separate local credential store; Environment Keystores hold or reference the credentials used by your Elyxis work.