Module auth 

The credential store: API keys drep holds on the user’s behalf.

drep.toml is a repository file. It names an endpoint, a model and a protocol, all of which are shareable, and it is meant to survive being committed - which is why api_key = "${VAR}" names an environment variable rather than holding a secret. That indirection is the right answer for CI, where the key arrives as a secret and nobody is at a keyboard, and the wrong answer for a person setting drep up on their laptop: it makes the first-run experience “now go and export something into the right shell profile”.

So keys live here instead, once per machine, outside any repository:

~/.config/drep/auth.toml     (macOS: ~/Library/Application Support/dev.slb350.drep)

Keyed by endpoint, not by provider name

A key authenticates a host, so the endpoint is what it belongs to. Keying by a preset name instead would mean a config that named no preset - a custom endpoint, or one edited by hand after drep init - could not find its own credential, and two presets pointed at the same host would each need their own copy of one key.

The endpoint is normalised before use (see normalise) so a trailing slash or a difference in case does not hide a key from the config that stored it.

There is deliberately no load_default/save_default pair. Both were thin wrappers over default_path(), which reads the environment - so nothing could test them without std::env::set_var, and the mutation gate found them undetectable. Every caller resolves the path once, at its own entry point, and passes it down; that is also what keeps tests off the real store.

Resolution order

resolve fills in what drep.toml left unset, in this order:

1. an explicit api_key - a literal, or a ${VAR} the loader has already substituted;
2. api_key_command, an argv drep runs to mint one;
3. a key held here for the same endpoint;
4. nothing, which LlmClient::new turns into not-needed.

An explicit value in the file always wins. A user who writes api_key = "${OPENROUTER_API_KEY}" has said where the key comes from, and silently preferring a stored one would make the file lie about what the run used. The command sits above the store for the same reason: a file naming a command has not left the question unanswered.

Structs

AuthStore

Keys held for this machine, keyed by normalised endpoint.

Declared

What one [[llm]] entry declares about its own credential.

Enums

AuthError

What can go wrong reading or writing the store.

KeyCommandError

Why a configured api_key_command did not produce a usable credential.

KeySource

Where a provider’s key came from, for doctor to report.

Constants

PATH_VAR

The environment variable that relocates the store.

Functions

default_path

The store location: PATH_VAR if set, else the platform’s config dir.

normalise

Canonical form of an endpoint for use as a store key.

path_from

default_path with the override supplied rather than read.

probe_key_command

Run one entry’s api_key_command and discard the credential.

resolve

Fill in keys the config left unset, and report where each one came from.

source_of

Where a provider’s key will come from, given what its config names.