Keys and sign-ins

Keys pasted into config files or prompts end up in commits, logs and screenshots, and a leaked key is exposed even if it is deleted a minute later.

1. Sign in with each tool's own command: claude auth login, codex login, or printenv OPENAI_API_KEY | codex login --with-api-key.
2. oah only runs claude auth status and codex login status and reads whether you are signed in.
3. For a key <NAME>, oah tries the environment variable, then the OS keychain (service oah, account <NAME>: the macOS login keychain, or a Windows Credential Manager generic credential with target oah:<NAME>), then nothing — the feature reports unused(no key).
4. TYPESAFE_API_KEY is for the Jev re-ranker; CONTEXT7_API_KEY and OPENAI_API_KEY for toolkit MCP servers; in v0.3.0, ARTIFICIAL_ANALYSIS_API_KEY adds optional benchmark scores.
5. oah init adds .env, .env.*, *.pem, *.key, .oah/secrets* and .claude/settings.local.json to .gitignore.

Store the Jev key in the macOS keychain; the command prompts for the value, so it never lands in shell history.

security add-generic-password -s oah -a TYPESAFE_API_KEY -w

• Nothing for oah's core: leases, packets, gates, the impact map, the wiki, review and landing work without any key.

• Without your Claude Code sign-in oah call claude cannot run; without your Codex sign-in oah review and oah fix cannot run.
• A key alone never turns the Jev re-ranker on; you must also enable it.
• If a key leaks: rotate it at the provider first, then remove it from files and commits, push the cleaned history, and store the new key in your environment or keychain.

• Keys › Which keys exist ↗Open in the explorer
• Keys › Where oah looks for a key ↗Open in the explorer
• Keys › If a key leaks ↗Open in the explorer

• Security: no secrets anywhere
• TypeSafe Jev, the optional judge
• Scores from Epoch AI, or your own Artificial Analysis key