Secrets

Secrets

Providers

Capabilities supports provider abstraction with env and encrypted local storage, with extension points for cloud providers.

Local encrypted store

Use the local store for self-hosted environments:

eidolon secrets set GITHUB_TOKEN ghp_xxx
eidolon secrets list

Key points:

• encrypted at rest
• values never returned to callers
• resolution happens only after policy allow

Rotation metadata

Tracked metadata includes:

• lastUsedAt
• expiresAt
• rotationDueAt
• usageCount

Use this to build alerts for stale or expiring credentials.

Temporary credentials

Provider flows can issue short-lived credentials for lower blast radius.