Module credential 

Multi-source credential resolution.

Reads API keys from multiple sources with clear priority:

1. OXIOS_<PROVIDER>_API_KEY env var (containers/K8s)
2. config.toml → [engine].api_key (explicit override)
3. oxios auth store (~/.oxios/auth.json, via OXI_HOME) — primary
4. shared oxi-cli store (~/.oxi/auth.json) — backward-compat read fallback, so keys registered via the standalone oxi CLI are still detected
5. oxi-ai env var fallback (CI/CD, containers)

Writes (store/onboarding/set_api_key) always target the oxios auth store (~/.oxios/auth.json), keeping oxios’s credentials isolated in its own product home. The shared ~/.oxi/auth.json is treated as read-only here.

Both the modern TokenBundle and the legacy oxi-cli ({"type":"api_key","key":"..."}) shapes are honored in either store.

Structs

CredentialStore

Multi-source credential resolver.

Enums

CredentialSource

Where a credential was found.

Functions

discover_auth_store_providers

Discover all provider names stored in either auth store.