# `MingaAgent.Credentials`
[🔗](https://github.com/jsmestad/minga/blob/main/lib/minga_agent/credentials.ex#L1)

API key storage, resolution, and management for agent providers.

Keys are stored in `~/.config/minga/credentials.json` with restrictive
file permissions (0600). Environment variables always take precedence
over stored keys so existing setups are never broken.

Resolution order:
1. Environment variable (e.g. `ANTHROPIC_API_KEY`)
2. Credentials file

Keys are never logged, never included in session exports, and never
sent to `*Messages*`.

# `key_source`

```elixir
@type key_source() :: :env | :file | :oauth | nil
```

Source where a key was found.

# `provider`

```elixir
@type provider() :: String.t()
```

A supported provider name.

# `provider_status`

```elixir
@type provider_status() :: MingaAgent.Credentials.ProviderStatus.t()
```

Status entry for a single provider.

# `any_configured?`

```elixir
@spec any_configured?() :: boolean()
```

Returns true if any provider has a configured API key.

# `dashboard_url_for`

```elixir
@spec dashboard_url_for(provider()) :: String.t() | nil
```

Returns the API key dashboard URL for a provider, or nil if unknown.

# `env_var_for`

```elixir
@spec env_var_for(provider()) :: String.t() | nil
```

Returns the environment variable name for a provider, or nil if unknown.

# `known_providers`

```elixir
@spec known_providers() :: [provider()]
```

Returns the list of known provider names.

# `oauth_configured?`

```elixir
@spec oauth_configured?() :: boolean()
```

Returns true if an `openai-codex` entry exists in `oauth.json`.

# `oauth_path`

```elixir
@spec oauth_path() :: String.t()
```

Returns the path to `~/.config/minga/oauth.json` (XDG-aware).

# `ollama_available?`

```elixir
@spec ollama_available?() :: boolean()
```

Returns true if Ollama appears to be running locally.

Makes a quick HTTP request to the Ollama API tags endpoint.
Returns false on connection errors or timeouts.

# `ollama_host`

```elixir
@spec ollama_host() :: String.t()
```

Returns the Ollama host URL. Checks `OLLAMA_HOST` env var first,
then falls back to the default localhost URL.

# `provider_from_model`

```elixir
@spec provider_from_model(String.t()) :: provider()
```

Extracts the provider name from a model string like "anthropic:claude-sonnet-4-20250514".

Returns `"anthropic"` for bare model names (no prefix), since Anthropic
is the default provider.

# `resolve`

```elixir
@spec resolve(provider()) :: {:ok, String.t(), key_source()} | :error
```

Resolves an API key for the given provider.

Checks the environment variable first, then the credentials file.
Returns `{:ok, key, source}` if found, or `:error` if no key is
configured anywhere.

# `revoke`

```elixir
@spec revoke(provider()) :: :ok | {:error, term()}
```

Removes a stored API key for a provider.

Only removes from the credentials file. Environment variables are
unaffected (and will still be used if set).

# `status`

```elixir
@spec status() :: [provider_status()]
```

Returns the auth status for all known providers plus Ollama and OpenAI OAuth.

Each entry shows whether a key is configured and where it was found
(`:env`, `:file`, `:oauth`, `:local`, or `nil`). Keys themselves are never exposed.

# `store`

```elixir
@spec store(provider(), String.t()) :: :ok | {:error, term()}
```

Stores an API key for a provider in the credentials file.

Creates the config directory and file if they don't exist. Sets
file permissions to 0600 (owner read/write only).

---

*Consult [api-reference.md](api-reference.md) for complete listing*