Initializing Credentials

When to Use This Skill

• First time setting up credentials for a project
• Adding production/staging environment-specific credentials
• Adding per-workflow credentials that override global ones
• Re-initializing credentials after losing a key file

Overview

The npx output credentials init command generates two files:

• A key file (.key) — the decryption secret. Never commit this.
• An encrypted YAML file (.yml.enc) — the credentials store. Safe to commit.

Commands

bash
# Global credentials (most common)
npx output credentials init

# Environment-specific
npx output credentials init -e production
npx output credentials init -e staging

# Per-workflow credentials (overrides globals for that workflow)
npx output credentials init -w my_workflow

# Force overwrite existing files
npx output credentials init --force

What Gets Created

Global (default)

config/
├── credentials.key        ← Add to .gitignore
└── credentials.yml.enc    ← Safe to commit

Environment-specific

config/credentials/
├── production.key         ← Add to .gitignore
└── production.yml.enc     ← Safe to commit

Per-workflow

src/workflows/{name}/
├── credentials.key        ← Add to .gitignore
└── credentials.yml.enc    ← Safe to commit

Default Template

After init, the encrypted YAML contains this template:

yaml
anthropic:
  api_key: ""
openai:
  api_key: ""
_env:
  ANTHROPIC_API_KEY: anthropic.api_key
  OPENAI_API_KEY: openai.api_key

The _env section wires credentials to environment variables automatically at worker startup. See output-credentials-env-vars for details.

After Init: Add Your Secrets

bash
npx output credentials edit          # Opens $EDITOR with decrypted YAML

Fill in the empty values, save, and close. The file is re-encrypted automatically.

Gitignore Setup

bash
echo "*.key" >> .gitignore
echo "config/credentials.key" >> .gitignore

Or add to your .gitignore:

# Credentials decryption keys — never commit
*.key
config/credentials.key
config/credentials/*.key
src/workflows/*/credentials.key

CI/CD: Key Distribution

In CI/CD pipelines, pass the key as an environment variable instead of committing the file:

bash
# Set in your CI/CD environment
OUTPUT_CREDENTIALS_KEY=<key-value>

# Environment-specific
OUTPUT_CREDENTIALS_KEY_PRODUCTION=<key-value>

# Per-workflow
OUTPUT_CREDENTIALS_KEY_MY_WORKFLOW=<key-value>

The key value is the contents of the .key file.

Verification Checklist

• ] config/credentials.key created (or env-specific variant)
• ] config/credentials.yml.enc created
• ] .key files added to .gitignore
• ] npx output credentials edit run to fill in secret values
• ] npx output credentials show verifies decryption works

Related Skills

• output-credentials-edit — Fill in and manage credential values
• output-credentials-env-vars — Wire credentials to environment variables
• output-dev-credentials — Full credentials system reference