# Secrets handling

Klyro never writes secret values. Credentials are represented by
environment-variable **names** in `klyro.yaml`:

```yaml
model:
  provider: openrouter
  model: anthropic/example-model
  credential:
    environment: OPENROUTER_API_KEY
```

Never place the value of `OPENROUTER_API_KEY`, a Telegram bot token, a
dashboard password, an API key, or any session secret inside `klyro.yaml`.

## What generation emits

- `.env.example` contains variable names, documentation, and blank
  placeholders only.
- The generated `.gitignore` ignores `.env`, so values you fill in locally
  stay out of version control.
- Generated documentation explains which variables each provider expects.

## Your workflow as operator

```bash
cd my-agent
cp .env.example .env    # fill in the referenced variable names
docker compose up -d
```

Keep `.env` local or feed it from your normal secret-management workflow.
Klyro does not manage live secrets and does not include a vault; see
[Limitations](/reference/limitations/). Diagnostics are designed to redact
known secret values rather than echo them.

## Why names instead of values

Names make the specification safe to commit, review, diff, share, and copy
between machines. They also keep the validation pipeline offline: nothing in
`validate`, `plan`, or `generate` contacts a model provider or any external
service to check credentials.

The [klyro.yaml reference](/configuration/klyro-yaml/) lists every field that
accepts a credential reference.