Keep provider keys in the OS vault instead of a file.
What the OS vault holds — names only, never values. Printing a secret would put it in this terminal's scrollback, in any screenshot of it, and in whatever recorded the session, which undoes the reason for having a vault.
This command takes no options.
Remove one credential from the OS vault.
NAMEstrrequiredThe credential to forget.
This command takes no options.
Put one credential in the OS vault. Prompted without echo by default, and that is not politeness: a key typed as an argument lands in the shell history of every machine it is typed on, which is the kind of file this command exists to stop using.
NAMEstrrequirede.g. OPENROUTER_API_KEY
--valuestrOmit to be prompted without echo.