use-native-credential-proxy

To migrate from OneCLI to a native credential proxy, replace the gateway with a lightweight in-process proxy that reads credentials from a .env file and injects them into container API requests. The process follows phased steps including pre-flight checks, code changes, and setup validations.

A .env-based credential proxy is a lightweight, in-process service that reads API keys or OAuth tokens from a local .env file and securely injects them into container API requests. It runs alongside containers, eliminating the need for external gateway services like OneCLI.

Yes, you can use a .env file to manage credentials by enabling NanoClaw's native credential proxy. This removes dependency on external services like OneCLI, allowing you to handle API keys or OAuth tokens locally and inject them directly into container API requests.

Yes, the NanoClaw native credential proxy supports phased migration from OneCLI across pre-flight, code-change, and setup phases. It ensures frontmatter requirements are satisfied and documents phase-driven steps and validations to migrate safely without disrupting existing container API requests.

A credential proxy is needed instead of hardcoding API keys to ensure container security and simplify local management. By reading credentials from a .env file, the proxy injects them into container API requests dynamically, preventing sensitive data exposure and removing external gateway dependencies.

Using a .env file for container credential management is limited to NanoClaw deployments where users want simple, local credential handling. It applies specifically to migrating from OneCLI and may not suit complex setups requiring external services or advanced OAuth token rotation across distributed environments.