output-dev-credentials

Encrypted Credentials Management

Overview

The @outputai/core/credentials package provides encrypted secrets management for Output SDK workflows. It replaces process.env patterns with a structured, encrypted YAML-based system that supports scoped credentials with deep merging.

When to Use This Skill

• Adding API keys or tokens to a workflow
• Migrating from process.env to encrypted credentials
• Setting up per-workflow or per-environment secrets
• Debugging missing credential errors (MissingCredentialError, MissingKeyError)
• Configuring custom credential providers (Vault, AWS Secrets Manager)

Library API

Import

import { credentials } from '@outputai/core/credentials';

credentials.get(path, defaultValue?)

Safe read with optional default. Never throws.

// Returns value or undefined
const region = credentials.get('aws.region');

// Returns value or default
const region = credentials.get('aws.region', 'us-east-1');

credentials.require(path)

Strict read. Throws MissingCredentialError if not found.

const apiKey = credentials.require('anthropic.api_key');

Error Types

All four extend FatalError, so a step that throws one fails without retries. A key error while resolving credential: env vars stops the worker at startup.

CLI Commands

# Initialize credentials (generates key + encrypted YAML template)
output credentials init                              # Global
output credentials init -e production                 # Environment-specific
output credentials init -w payment_processing         # Workflow-specific

# Edit credentials (decrypts, opens $EDITOR, re-encrypts on save)
output credentials edit                               # Global
output credentials edit -e production                  # Environment
output credentials edit -w payment_processing          # Workflow

# Show decrypted credentials (debugging)
output credentials show                               # Global
output credentials show -e development                 # Environment

# Set a single credential value (no editor needed)
output credentials set anthropic.api_key sk-ant-...    # Global
output credentials set stripe.key sk_live_... -w payment_processing # Workflow

# Get single credential value
output credentials get anthropic.api_key               # Global
output credentials get stripe.key -w payment_processing # Workflow