`hiveloom credential`

Stores the provider API keys that agents use for inference. Hiveloom never accepts a secret as a CLI flag — every value is read from an environment variable, a file, or stdin.

Synopsis


hiveloom credential [GLOBAL FLAGS] <COMMAND>

Global flags

Flag	Default	Description
`--tenant <TENANT>`	`default`	Tenant slug.
`--endpoint <URL>`	—	API endpoint.
`--token <TOKEN>`	—	Bearer token for remote access.
`--json`	—	JSON output.

Subcommands

Subcommand	Purpose
`set`	Store a credential.
`list`	List credential names. Never prints values.
`rotate`	Replace the secret value of an existing credential.
`remove`	Delete a credential.

Storing a credential

The value comes from one of three sources:

Source	Flag
Environment variable	`--from-env <VAR_NAME>`
File on disk	`--from-file <PATH>`
stdin	(omit both flags; pipe the secret in)

Examples

From an env var (most common):


export ANTHROPIC_API_KEY="sk-ant-..."
hiveloom credential set --name anthropic-default --from-env ANTHROPIC_API_KEY
unset ANTHROPIC_API_KEY        # don't leave it in your shell history

From a file (e.g. piped from a secret manager):


op read "op://Engineering/anthropic/api-key" > /tmp/anth.key
hiveloom credential set --name anthropic-default --from-file /tmp/anth.key
shred -u /tmp/anth.key

From stdin:


echo "sk-ant-..." | hiveloom credential set --name anthropic-default

List, rotate, remove


hiveloom credential list                # names only
hiveloom credential rotate --name anthropic-default --from-env ANTHROPIC_API_KEY
hiveloom credential remove --name anthropic-default

Provider model-id formats

When you use the credential from an agent, the model ID format is provider-specific:

Provider	Model-ID format	Example
Anthropic	`anthropic:<id>`	`anthropic:claude-sonnet-4-6`
OpenAI	`openai:<id>`	`openai:gpt-4o`
Local (Ollama)	`ollama:<id>`	`ollama:llama3:70b`

See Store an LLM credential for the guided walkthrough.

Storage

Credentials are encrypted at rest with the per-instance master key under <data-dir>/master.key. Plaintext only exists in memory at request time and is scrubbed from logs. They never leave the tenant container.