Where an endpoint’s API key comes from, or that it needs none.
One value rather than three fields. The previous shape —
api_key + api_key_env + requires_api_key — could represent eight
combinations for four meanings, and the contradictions were not theoretical:
“needs a key” was once inferred from “names an environment variable”, so a
host holding its key in a vault reported that no credential was required
and looked permanently ready. No pair of fields can disagree here.
The secret itself. Never enters the environment, so it is not inherited
by children this crate spawns — including the bash tool, which would
otherwise put the key running the agent within the agent’s reach.
The variable this key is read from, when it is read from one. Lets a
host say “set OPENROUTER_API_KEY” only when that is actually the
instruction; naming a variable to someone passing a value is a dead end.