Hold No Keys

A Tool That Cannot Authenticate

The workshop calls paid external providers on every run — speech synthesis for narration, sometimes image generation for art cards. Both require credentials. The workshop holds neither. It cannot authenticate to any external service, and there is no configuration in which it could.

Instead, every provider call is routed through the sibling that owns the relationship with that provider. The workshop makes a local call to a sibling; the sibling holds the key and makes the real one. From the workshop's side, synthesizing speech looks like calling a function on a neighbor, and no secret ever enters its process.

What Zero Buys You

The obvious win is blast radius. A repository with no secrets cannot leak any, which means the commit history is safe to be careless with, a machine that runs it does not become a credential store, and every accidental log dump is boring instead of an incident.

The less obvious win is rotation. When a provider key changes — because it expired, or leaked elsewhere, or the account moved — you update it in exactly one place. Contrast the version where four tools each hold a copy: rotation becomes a coordinated change across four repositories, so it gets delayed, so keys live longer than they should, so the rotation policy quietly becomes fiction. Centralizing the credential is what makes rotating it cheap enough to actually do.

There is a third benefit that only shows up during an incident. When someone asks "could this component have leaked the key?", a repository that never held one answers in a word. Everything else requires an investigation — reading configuration, checking process environments, searching logs for accidental prints. Being able to eliminate a component from an investigation immediately is worth a surprising amount at the moment you need it, and it is a property you can only have by design beforehand.

The Cost, Stated Honestly

This is not free. The workshop now cannot run without its sibling reachable, which means a local development setup needs that sibling running, and a failure in the sibling looks like a failure in the workshop. You have traded a distributed secret problem for a local availability dependency.

That trade is right here because the sibling is already a hard dependency for other reasons and both run on the same machine. It would be wrong for a tool that must work in isolation, on someone else's laptop, or inside a build agent with no access to your infrastructure. The principle worth carrying is not "never hold keys" — it is that credentials should live at exactly one layer, and you should be able to say which layer that is without looking it up.

Code

What a provider call looks like from a keyless tool·python

def synthesize(text: str, voice: str, out: Path) -> Path:
    """No key, no provider SDK, no auth header - a local call.

    The sibling owns: the credential, the voice registry, text
    normalization, and the cache. This function owns: asking.
    """
    resp = httpx.post(
        f"{SIBLING_BASE}/api/tts",         # localhost, not a provider
        json={"text": text, "voice": voice},
        timeout=180,
    )
    resp.raise_for_status()
    out.write_bytes(resp.content)
    return out


# There is deliberately no os.environ["..."] anywhere in this repo
# for a provider credential. Not "loaded carefully" - absent.

Rotation cost as a function of where keys live·text

keys copied into every tool          key held by one owner
--------------------------          ---------------------
rotate = N coordinated changes      rotate = 1 change
leak surface = N repos              leak surface = 1 repo
N histories to audit                1 history to audit
"who has this key?" = a survey      "who has this key?" = a name

# The failure is not that N is insecure in principle.
# It is that rotation gets expensive, so it stops happening,
# and a policy nobody executes is not a policy.

Exercise

Pick one external provider credential in a system you work on and trace every place a copy of it exists — repositories, environment files, deployment configs, developer machines, build agents. Write the number down. Then estimate what a rotation would cost today in coordinated changes, and design the version where exactly one component holds it and the rest call that component.

Hint

Count developer laptops and continuous-integration configuration; those are where copies hide. If rotation requires messaging anyone to update a local file, the credential is not centralized regardless of what the deployment documentation says.