# Open Cloud credential settings

Run `romcp cloud`, select **Enter or replace API key**, and paste the key into the masked prompt. This option is first, including in short terminals. Windows uses DPAPI; macOS uses the login Keychain, with only an opaque reference saved in `~/.dominus/open-cloud-credential.json`. macOS may ask you to unlock the login Keychain or allow access. Keychain writes use the built-in `/usr/bin/security` interactive stdin interface, keeping keys out of process arguments. Keys exceeding its 4096-byte command-line input budget are rejected before saving; use an environment variable for those keys. Linux currently uses `ROBLOX_OPEN_CLOUD_API_KEY`.

The terminal verifies saved keys with Roblox introspection. The control panel also offers **Verify active key and permissions**. A scope report does not guarantee access to every experience or operation. The environment variable continues to override saved keys.

macOS adapter tests cover escaping, size limits, verification, and cleanup with a mocked Keychain runner. Native macOS access prompts and Keychain persistence require testing on a Mac before claiming live validation.

## Original Windows implementation notes

Open the local control panel with `show_dominus_ui`. In **Open Cloud**, load credential status, enter a replacement API key, and choose **Save encrypted key**. New saves use Windows DPAPI, scoped to the current Windows user, in `~/.dominus/open-cloud-credential.json`. The plaintext key is passed to the Windows helper through stdin, not command arguments, and never written to the new store. Password inputs are cleared after each operation, including failure.

The saved key is shared by the existing asset-upload and commerce tools. Resolution order is:

1. `ROBLOX_OPEN_CLOUD_API_KEY` in the running process environment.
2. The protected credential store.
3. The existing `openCloudApiKey` value in legacy romcp configuration.

The panel shows the active source and whether a legacy key also exists. Removing the protected key leaves environment and legacy configuration intact; those may become active again. This avoids silently deleting existing setup. Legacy plaintext credentials are not migrated automatically in this version. Replace or remove them separately through your existing configuration workflow if you no longer need them.

The status endpoint never returns the key or a key suffix. Saves use revision checks and an exclusive update lock. A failed protection/roundtrip check preserves the old credential. Tools cache decrypted material in process memory, invalidating it when the stored ciphertext changes; each request checks the file before reuse. DPAPI protection does not protect against software running as the same Windows user.

**Configured is not verified.** The save endpoint checks local storage; use the separate permission check for Roblox validity. Named profiles, creator selection in the panel, OAuth, and Linux native secret storage remain outstanding.

Tests cover precedence, persistence, stale writes, cache invalidation, failed-protection preservation, and a real Windows DPAPI roundtrip using a synthetic key. A browser check exercised the actual local save/remove endpoint with an isolated test store, verified that responses did not contain the key, and checked password-field clearing and mobile layout.