Choose a disposable key name first
Use an environment-style name such as COURSE_2_TEST_TOKEN. Never use a real credential merely to practice.
Separate provider keys from tool credentials
Provider keys and integration secrets have different storage commands.
| Credential | Command family |
|---|---|
| LLM provider key | armaraos config set-key |
| Integration or outside-tool token | armaraos vault |
Name each vault key for the service and scope it represents.
Initialize the vault once
armaraos vault init
If the vault is already initialized, do not reset or replace it.
Store one value outside the recording
armaraos vault set <KEY>The verification PTY echoed entered text. Treat the complete entry moment as secret and rotate any real value that appears in a recording.
Prove that listing hides values
armaraos vault list
This is the useful safety proof. The key name is visible, while the value is not. Vault commands do not accept --json.
Use the separate remove command
armaraos vault remove <KEY>
Removing an integration later does not guarantee its credential disappeared. Remove the vault key separately. Local removal still does not revoke it at the source service.
Check it / run this yourself
See a name and no value.
armaraos vault listA key you intend to keep appears by name with no value. If you used a disposable key, remove it and return to the previous inventory.
Anything reachable through a credential can be acted on with that credential's permissions. Scope tokens narrowly, add them only when needed, and stop recording before entry.
Troubleshooting for this sitting
| What you see | Likely cause | What to do |
|---|---|---|
| Vault is not initialized | One-time setup has not run. | Run vault init. |
| Entered text is visible | Terminal echo is active. | Stop capture and rotate a real secret if exposed. |
| Vault is empty | No values are stored. | Add only a credential currently needed. |
--json errors | Vault has no JSON flag. | Use the human inventory. |