Skip to content

Wire credential management

The credentials command is registered by default, but it has nothing to show until the tool tells it which credentials exist.

Declare the credentials on your config type

credentials_from takes anything implementing rtb_credentials::CredentialBearing — usually your typed config struct.

let config = Arc::new(my_config.clone());

Application::builder()
    .metadata(metadata)
    .version(rtb_app::version_info!())
    .credentials_from(config)
    .build()?

A tool that skips this step is not broken: credentials list prints an empty table and credentials doctor succeeds trivially. The subtree degrades rather than erroring at startup.

Declare the layers you actually want

Each CredentialRef can declare env, keychain, literal and fallback_env. The resolver tries them in that order and stops at the first hit. Which ones you declare changes what the CLI can do:

Layers declared credentials add credentials remove
keychain (with or without others) Prompts and stores in the OS keychain Deletes from the keychain
env only Prompts, discards, prints an export line Fails — nothing to remove
literal only Refuses Refuses
none Fails — no settable layer Fails

Declare a keychain layer if you want credentials add to be able to store anything. Without one, add is an instruction printer.

Verify from the CLI

$ mytool credentials list
 name      | service | account | mode | status
-----------+---------+---------+------+--------
 api-token | mytool  | default | env  | -

$ mytool credentials test api-token
 name      | source | status
-----------+--------+----------
 api-token | env    | resolved

list reads the config shape and performs no I/O — its mode column names the first declared layer, and its status column is always -. test and doctor are the ones that actually probe.

credentials doctor fails the run if any credential does not resolve, which makes it a usable CI check.

Remember to put --output json after the subcommand name for this subtree: mytool credentials list --output json.

Wire a release credential separately

ToolMetadata::release_credential is a different field, used only by self-update to authenticate against a private release source. It is not part of credentials_from, and it does not appear in credentials list.