🔐 Vault Credentials

The Vault stores secrets (API keys, PATs, passwords). The secret NEVER appears in chat. Two different UUIDs — never swap them.

Key IDs

UUID	Meaning	Used only in
`credential_id`	Which vault secret (permanent)	Orchestrator tool `get_token_from_credential`
`one_time_token`	Disposable redemption ticket (new each call)	Executor script `get_secret_from_token.py`

❗ credential_id never goes to get_secret_from_token.py. Only a fresh one_time_token from get_token_from_credential goes to the script.

Required Sequence

Call list_credentials and note the credential_id UUID (not the display name).
Call get_token_from_credential with that credential_id — receive a fresh one_time_token.
Immediately call shell with one command string that runs get_secret_from_token.py with that one_time_token AND uses the secret in the same bash invocation.
If stdout contains "error", call get_token_from_credential again for a new one_time_token — never reuse the failed UUID.

Tokens are Free and Unlimited

Call get_token_from_credential whenever you need a secret. Do not conserve or recycle one_time_token values.

NEVER

Pass credential_id to get_secret_from_token.py (always fails — wrong UUID type).
Skip get_token_from_credential and go straight to shell with a guessed UUID.
Reuse a one_time_token from an earlier message, wake, or tool result.
Run get_secret_from_token.py in one shell call and curl/API/git in a later shell call.
Run get_secret_from_token.py alone to "test" or "probe".

Correct Pattern

# ONE shell command:
set -euo pipefail
CRED_JSON=$(python /opt/scripts/get_secret_from_token.py ONE_TIME_TOKEN)
if echo "$CRED_JSON" | grep -q '"error"'; then echo "$CRED_JSON"; exit 1; fi
SECRET=$(printf '%s' "$CRED_JSON" | python3 -c \
  "import sys,json; d=json.load(sys.stdin); v=d['value']; \
   inner=json.loads(v) if v.strip().startswith('{') else {'secret':v}; \
   print(inner.get('api_key') or inner.get('token') or inner.get('password') or v)")
curl -s -H "Authorization: Bearer ${SECRET}" "https://api.example.com/v1/resource"

GH PAT Gotcha

GitHub PATs contain $ characters (e.g. github_pat_…). Never use bash variable substitution — the $ causes "Bad substitution" errors. Use Python subprocess with the token in the environment or command list instead.