# `WardrikCore.Keys`

Gives your code its API keys, such as a model provider's.

    defmodule MyApp.Keys do
      @behaviour WardrikCore.Keys

      @impl true
      def fetch(%WardrikCore.Keys.Request{name: name, principal: principal}, _opts) do
        case MyApp.Secrets.key(principal.id, name) do
          nil -> {:error, :not_found}
          key -> {:ok, key}
        end
      end
    end

Give it to an agent as `keys: {MyApp.Keys, opts}`, or to Wardrik as `key_source:`. Your code
fetches what it needs:

    with {:ok, key} <- WardrikCore.Keys.fetch(context, "BRAVE_API_KEY") do
      Brave.search(key, query)
    end

  * Each model call fetches its provider's key, such as `ANTHROPIC_API_KEY`. With none, ReqLLM
    uses its config or the environment.
  * Keys are never saved or emitted.
  * A person's own tokens belong in `WardrikCore.Credentials`.

# `fetch`

```elixir
@callback fetch(WardrikCore.Keys.Request.t(), opts :: term()) ::
  {:ok, String.t()} | {:error, :not_found} | {:error, term()}
```

Returns the key the request names, `{:error, :not_found}`, or why it can't.

# `fetch`

```elixir
@spec fetch(WardrikCore.Context.t(), String.t()) ::
  {:ok, String.t()} | {:error, term()}
```

Fetches the key `name` for the agent. Returns `{:error, :not_found}` if there's none.

# `key_name`

```elixir
@spec key_name(LLMDB.Model.t() | String.t()) :: String.t() | nil
```

Returns the name of the key `model`'s provider takes, or `nil`.

    WardrikCore.Keys.key_name("zai:glm-5.1")
    #=> "ZAI_API_KEY"

# `model_options`

```elixir
@spec model_options(WardrikCore.Context.t(), LLMDB.Model.t() | String.t()) ::
  keyword()
```

Returns `[api_key: key]` for `model`'s provider, or `[]` if there's no key.

---

*Consult [api-reference.md](api-reference.md) for complete listing*