scbe-api-key-local-mirror
Securely mirror API keys from environment or prompt into a local Windows DPAPI-encrypted token store, then resolve them back into runtime env vars for terminal workflows. Use when users ask for quick
Files1
View on GitHubSKILL.mdresearch/sphere-grid/skills/scbe-api-key-local-mirror/SKILL.md
GitHubSCBE API Key Local Mirror
Maintain a second local destination for secrets without plaintext storage.
Quick Start
- Run health check:
python C:/Users/issda/.codex/skills/scbe-api-key-local-mirror/scripts/key_mirror.py doctor
- Store World Anvil key from existing env var:
python C:/Users/issda/.codex/skills/scbe-api-key-local-mirror/scripts/key_mirror.py store --service world_anvil --env WORLD_ANVIL_API_KEY
- Resolve into current shell variable:
python C:/Users/issda/.codex/skills/scbe-api-key-local-mirror/scripts/key_mirror.py resolve --service world_anvil --env-out WORLD_ANVIL_API_KEY
- List mirrored keys:
python C:/Users/issda/.codex/skills/scbe-api-key-local-mirror/scripts/key_mirror.py list
Workflow
- Prefer
--envinput to avoid putting raw keys in shell history. - Store with service name normalization (
world_anvil,youtube,buffer, etc.). - Use
resolve --env-outduring runtime just-in-time. - Keep masked output by default; use
--rawonly if absolutely required.
Invariants
- Never print full key values unless explicitly requested (
--raw). - Never commit vault files to git.
- Keep keys encrypted via Windows DPAPI at rest.
- Keep source-traceable metadata (token_id + fingerprint).
Resource Guide
scripts/key_mirror.py: DPAPI store/list/resolve utility.references/world-anvil-usage.md: World Anvil access lane using mirrored keys.