Credentials

[credentials.github]
title = "GitHub OAuth app"
guide = """
1. Open https://github.com/settings/applications/new.
2. Give it the callback URL below, then register it.
3. Copy its Client ID, then generate a client secret.
"""
copy = { callback = "Authorization callback URL" }
hosts = ["github.com"]
secrets = [
    { name = "GITHUB_CLIENT_ID", label = "Client ID", masked = false },
    { name = "GITHUB_CLIENT_SECRET", label = "Client secret" },
]

A credential groups the secrets a person gets from one provider. Setting secrets, the person sees its guide (Markdown) once, the values in copy that the request supplies, and each secret by its label, its name when absent. masked, true when absent, hides the value while it is typed. Saved values are never returned, including unmasked fields. pattern, a regular expression, refuses a value that does not match it. hosts declares the destinations its secrets may reach, each named in full. The person provisioning a value sees these destinations but cannot edit them. Changing destinations requires a manifest change, redeployment and fresh provisioning. A secret is declared once: in secrets or in one credential.

[credentials.github]
title = "GitHub token"
optional = true
hosts = ["api.github.com"]
secrets = [{ name = "GITHUB_TOKEN", label = "Personal access token" }]

optional = true lets the service run with the credential unset. A header naming one of its unset secrets is left off the request, so the call goes out anonymous; a body naming one is refused. crab deploy starts the service with it unset, and crab secret request asks for it only when --credential names it.