# keys-on-the-wire (kow): set this up for the user

You are an AI agent. The user asked you to set up **keys-on-the-wire (kow)**, a
local proxy already installed on their machine that swaps a placeholder for a real
API key in-flight, so no agent ever holds the raw credential.

## Your job

When the user wants to give an app (or you) access to an API, do NOT ask for the
raw key. Instead:

1. Run:

       kow binding new --host <api-host> --name <ENV_VAR_NAME>

   Example:

       kow binding new --host api.stripe.com --name STRIPE_API_KEY

2. The command prints two things:

   - stdout: a small note starting with `# kow-binding`. Tell the user to paste it
     into that secret's notes / annotation in their vault (Bitwarden Secrets
     Manager, Google Secret Manager, AWS Secrets Manager, and so on). You never
     store the real key; the user puts the real value in the vault themselves.

   - stderr: a line like `export STRIPE_API_KEY='avp-PLACEHOLDER-...'`. Wire this
     placeholder into the app's .env / config now, in this same session. The app
     emits the placeholder; kow swaps in the real key on the wire.

3. Tell the user to restart the kow daemon (it reads bindings on reload), then
   confirm with:

       kow doctor

## Hard rules

- Never ask for, print, echo, or store the raw secret. Only ever handle the
  placeholder. Using the placeholder everywhere the key would go is the whole point.

- If `kow binding new` refuses the host, or the auth is not a simple Bearer / token
  header (OAuth, Basic assembled from two parts, multi-host, per-path scope), STOP
  and read the full skill before proceeding:

      https://github.com/inflightsec/keys-on-the-wire/blob/main/skills/kow/SKILL.md

  It documents the note schema, the auth-pattern catalog, and the OAuth flow.

- Do not edit kow's config file directly to add a secret. Modern kow reads bindings
  from each secret's own vault metadata (notes-first, no redeploy).

## kow not installed yet?

If `kow` is not found, the user needs the proxy itself first:

    macOS:  brew install inflightsec/keys-on-the-wire/keys-on-the-wire
    Linux:  pipx install keys-on-the-wire

then:

    sudo kow setup

Full docs: https://github.com/inflightsec/keys-on-the-wire