Struct CredentialRef 

pub struct CredentialRef {
    pub env: Option<String>,
    pub keychain: Option<KeychainRef>,
    pub literal: Option<SecretBox<str>>,
    pub fallback_env: Option<String>,
}

Declarative reference to a credential that the Resolver walks through the documented precedence chain: env > keychain > literal > fallback_env.

Downstream tools carry this in their config structs, e.g.

use rtb_credentials::CredentialRef;

#[derive(serde::Deserialize)]
struct AnthropicCfg {
    api: CredentialRef,
}

Serialize is deliberately not derived: SecretString does not implement Serialize (secrecy crate removed it to prevent blind round-trip leaks). Tools writing credentials to config should go through a dedicated “write secret” path that redacts or skips the literal.

Fields

env: Option<String>

Name of an environment variable carrying the secret. Checked first.

keychain: Option<KeychainRef>

OS-keychain lookup descriptor. Checked second.

literal: Option<SecretBox<str>>

Literal secret embedded in config. Checked third. Refused when the process is running under CI=true (see CredentialError::LiteralRefusedInCi).

Note: SecretString round-trips through serde with the secrecy crate’s serde feature. The raw value is zeroed on drop and redacted in Debug.

fallback_env: Option<String>

Name of an ecosystem-default env var used as a last-chance fallback (e.g. ANTHROPIC_API_KEY). Checked last.

Trait Implementations

impl Clone for CredentialRef

fn clone(&self) -> CredentialRef

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialRef

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for CredentialRef

fn default() -> CredentialRef

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CredentialRef

fn deserialize<__D>( __deserializer: __D, ) -> Result<CredentialRef, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.