Credential Management

Nexus OS provides secure credential management for API keys, tokens, and secrets.

How Credentials Work

Credentials are stored encrypted in the Nexus database and injected at runtime:

# Store a credential
naos secret set OPENAI_API_KEY sk-...

# List stored credentials (values hidden)
naos secret list

# Remove a credential
naos secret delete OPENAI_API_KEY

Credential Scoping

Credentials can be scoped to specific agents:

agents:
  planner:
    secrets:
      - OPENAI_API_KEY
      - ANTHROPIC_API_KEY
  coder:
    secrets:
      - GITHUB_TOKEN

Agents can only access secrets explicitly assigned to them.

Encryption

All credentials are encrypted at rest using AES-256-GCM. The encryption key is derived from:

1. A master key stored in the project's .nexus/ directory
2. A per-credential salt
3. PBKDF2 key derivation with 100,000 iterations

Best Practices

• Never hardcode secrets in agent source code
• Rotate credentials regularly using naos secret set
• Use scoped credentials — only give agents the secrets they need
• Audit access — check naos audit for credential usage patterns