Credential helpers
How git, Docker, Python's keyring and any command get their secrets from Keyward instead of from files and environment variables, as designed, and the one rule every helper keeps.
Designed, not built. The helpers below are part of the first Keyward Desktop release and do not exist yet.
The idea
Most tools that need a credential already have a place to plug a helper in: git has credential.helper, Docker
has credsStore and credHelpers, Python's keyring has backends, and almost everything reads environment
variables. A helper answers the tool's own protocol by asking the Keyward Service, under the policy for that tool,
so the value never sits in a file in your home directory, in a shell history or in Credential Manager.
| Helper | What it replaces | How it is used |
|---|---|---|
git-credential-keyward |
credentials in .git-credentials or in Credential Manager |
git config --global credential.helper keyward |
docker-credential-keyward |
the Docker config file's stored logins | "credsStore": "keyward" in Docker's config |
the keyring backend |
passwords keyring would keep in Credential Manager |
installed with the Desktop; keyring finds it by itself |
keyward run -- <command> |
secrets exported into a shell or written into a .env file |
the project's secrets are placed into the command's environment, for that command only |
The one rule
A value is never on a command line. Every process on a computer can read every other process's arguments, so a helper never passes a secret as an argument, to anything, ever. Values travel in environments, pipes and file descriptors, and the helpers are tested for it: a scanner reads the arguments of every process a helper starts and fails the build if a value appears.
Where the value comes from
A helper is a caller like any other: the Keyward Service identifies it by its signed program image and the user's
account, and answers under the policy for it. By default a helper may inject, that is, receive a value to hand
to its tool; it may not reveal anything to a person and it may not list. You can tighten that per project, or ask
for a Windows Hello prompt the first time a tool asks for a project's secrets each day.
Import from Credential Manager
Keyward Desktop can import the entries you choose from Windows Credential Manager into the vault, one way, so that a helper serves them from then on. What Windows itself needs (Remote Desktop, shares, a domain) is left where it is. See Keyward Desktop and the Keyward Service.
For the command line
keyward run, keyward export and the rest of the Keyward command line are the upstream command line, rebranded
and signed. On a computer with Keyward Desktop, the command line talks to the service; without it, the command line
talks to a Keyward server with a machine identity or a person's sign-in, as upstream's does today.