Secrets handling

Klyro never writes secret values. Credentials are represented by environment-variable names in klyro.yaml:

model:
  provider: openrouter
  model: anthropic/example-model
  credential:
    environment: OPENROUTER_API_KEY

Never place the value of OPENROUTER_API_KEY, a Telegram bot token, a dashboard password, an API key, or any session secret inside klyro.yaml.

What generation emits

• .env.example contains variable names, documentation, and blank placeholders only.
• The generated .gitignore ignores .env, so values you fill in locally stay out of version control.
• Generated documentation explains which variables each provider expects.

Your workflow as operator

cd my-agent
cp .env.example .env    # fill in the referenced variable names
docker compose up -d

Keep .env local or feed it from your normal secret-management workflow. Klyro does not manage live secrets and does not include a vault; see Limitations. Diagnostics are designed to redact known secret values rather than echo them.

Why names instead of values

Names make the specification safe to commit, review, diff, share, and copy between machines. They also keep the validation pipeline offline: nothing in validate, plan, or generate contacts a model provider or any external service to check credentials.

The klyro.yaml reference lists every field that accepts a credential reference.