/output-credentials-init

name: output-credentials-init
description: Initialize encrypted credentials for an Output.ai project. Use when setting up credentials for the first time, adding environment-specific credentials, or adding per-workflow credentials.
allowed-tools: [Read, Bash, Glob]

Initializing Credentials

When to Use This Skill

• First time setting up credentials for a project
• Adding production/staging environment-specific credentials
• Adding per-workflow credentials that override global ones
• Re-initializing credentials after losing a key file

Overview

The `npx output credentials init` command generates two files:

• A **key file** (`.key`) — the decryption secret. **Never commit this.**
• An **encrypted YAML file** (`.yml.enc`) — the credentials store. Safe to commit.

Commands

# Global credentials (most common)
npx output credentials init

# Environment-specific
npx output credentials init -e production
npx output credentials init -e staging

# Per-workflow credentials (overrides globals for that workflow)
npx output credentials init -w my_workflow

# Force overwrite existing files
npx output credentials init --force

What Gets Created

Global (default)

config/
├── credentials.key        ← Add to .gitignore
└── credentials.yml.enc    ← Safe to commit

Environment-specific

config/credentials/
├── production.key         ← Add to .gitignore
└── production.yml.enc     ← Safe to commit

Per-workflow

src/workflows/{name}/
├── credentials.key        ← Add to .gitignore
└── credentials.yml.enc    ← Safe to commit

Default Template

After init, the encrypted YAML contains this template:

anthropic:
  api_key: ""
openai:
  api_key: ""
_env:
  ANTHROPIC_API_KEY: anthropic.api_key
  OPENAI_API_KEY: openai.api_key

The `_env` section wires credentials to environment variables automatically at worker startup. See `output-credentials-env-vars` for details.

After Init: Add Your Secrets

npx output credentials edit          # Opens $EDITOR with decrypted YAML

Fill in the empty values, save, and close. The file is re-encrypted automatically.

Gitignore Setup

echo "*.key" >> .gitignore
echo "config/credentials.key" >> .gitignore

Or add to your `.gitignore`:

# Credentials decryption keys — never commit
*.key
config/credentials.key
config/credentials/*.key
src/workflows/*/credentials.key

CI/CD: Key Distribution

In CI/CD pipelines, pass the key as an environment variable instead of committing the file:

# Set in your CI/CD environment
OUTPUT_CREDENTIALS_KEY=<key-value>

# Environment-specific
OUTPUT_CREDENTIALS_KEY_PRODUCTION=<key-value>

# Per-workflow
OUTPUT_CREDENTIALS_KEY_MY_WORKFLOW=<key-value>

The key value is the contents of the `.key` file.

Verification Checklist

• [ ] `config/credentials.key` created (or env-specific variant)
• [ ] `config/credentials.yml.enc` created
• [ ] `.key` files added to `.gitignore`
• [ ] `npx output credentials edit` run to fill in secret values
• [ ] `npx output credentials show` verifies decryption works

Related Skills

• `output-credentials-edit` — Fill in and manage credential values
• `output-credentials-env-vars` — Wire credentials to environment variables
• `output-dev-credentials` — Full credentials system reference