Gives your code its API keys, such as a model provider's.

defmodule MyApp.Keys do
  @behaviour WardrikCore.Keys

  @impl true
  def fetch(%WardrikCore.Keys.Request{name: name, principal: principal}, _opts) do
    case MyApp.Secrets.key(principal.id, name) do
      nil -> {:error, :not_found}
      key -> {:ok, key}
    end
  end
end

Give it to an agent as keys: {MyApp.Keys, opts}, or to Wardrik as key_source:. Your code fetches what it needs:

with {:ok, key} <- WardrikCore.Keys.fetch(context, "BRAVE_API_KEY") do
  Brave.search(key, query)
end

• Each model call fetches its provider's key, such as ANTHROPIC_API_KEY. With none, ReqLLM uses its config or the environment.
• Keys are never saved or emitted.
• A person's own tokens belong in WardrikCore.Credentials.