# rtb-credentials
> Part of the [phpboyscout Rust toolkit](https://rust.phpboyscout.uk):
> small, framework-free crates extracted from
> [rust-tool-base](https://gitlab.com/phpboyscout/rust-tool-base).
OS keychain credential storage: the `CredentialStore` async trait with
keyring / env / literal / in-memory implementations, plus a `Resolver`
that walks the canonical `env > keychain > literal > fallback_env`
precedence chain. Every secret crosses the boundary as
`secrecy::SecretString`, so `Debug` renders `SecretBox<str>([REDACTED])`
and the memory is zeroed on drop.
```rust
use rtb_credentials::{CredentialRef, CredentialStore, KeyringStore, Resolver};
use std::sync::Arc;
let store: Arc<dyn CredentialStore> = Arc::new(KeyringStore::new());
let resolver = Resolver::new(store);
let cref: CredentialRef = /* deserialised from the tool's config */;
let api_key = resolver.resolve(&cref).await?;
```
On Linux the keychain is the freedesktop Secret Service (GNOME Keyring,
KWallet), which persists across reboots and needs a D-Bus session bus at
run time. libdbus is compiled in from source, so the build host needs a
C compiler for the target but no D-Bus packages. The `linux-persistent`
feature is kept for compatibility and has no effect.
- **Docs:** <https://credentials.rust.phpboyscout.uk>
- **API reference:** <https://docs.rs/rtb-credentials>
- **Crate:** <https://crates.io/crates/rtb-credentials>
## Development
`just ci` runs the full local gate (fmt, clippy, nextest, doc, deny).
Tests include a cucumber BDD suite (`tests/bdd.rs`). Releases are cut by
colophon from Conventional Commits, so do not tag manually.
## License
MIT