# rtb-credentials
> Part of the [phpboyscout Rust toolkit](https://rust.phpboyscout.uk) —
> small, framework-free crates extracted from
> [rust-tool-base](https://gitlab.com/phpboyscout/rust-tool-base).
OS keychain credential storage: the `CredentialStore` async trait with
keyring / env / literal / in-memory implementations, plus a `Resolver`
that walks the canonical `env > keychain > literal > fallback_env`
precedence chain. Every secret crosses the boundary as
`secrecy::SecretString` — `Debug` renders `[REDACTED]`, memory is
zeroed on drop.
```rust
use rtb_credentials::{CredentialRef, CredentialStore, KeyringStore, Resolver};
use std::sync::Arc;
let store: Arc<dyn CredentialStore> = Arc::new(KeyringStore::new());
let resolver = Resolver::new(store);
let cref: CredentialRef = /* deserialised from the tool's config */;
let api_key = resolver.resolve(&cref).await?;
```
On Linux the default backend is pure-Rust kernel keyutils
(session-scoped, no system deps); enable the `linux-persistent` feature
for reboot-persistent storage via the freedesktop Secret Service
(requires `pkg-config` + `libdbus-1-dev` at build time).
- **Docs:** <https://credentials.rust.phpboyscout.uk>
- **API reference:** <https://docs.rs/rtb-credentials>
- **Crate:** <https://crates.io/crates/rtb-credentials>
## Development
`just ci` runs the full local gate (fmt, clippy, nextest, doc, deny).
Tests include a cucumber BDD suite (`tests/bdd.rs`). Releases are cut by
release-plz from Conventional Commits — do not tag manually.
## License
MIT