ophix-cred-client

Python client for ophix-creds credential servers.

Provides a CLI for operators and an importable library for automation scripts and Tier 2 clients. Credentials are fetched on demand and never persisted to disk.

Installation

pip install ophix-cred-client venv-cmds

venv-cmds is optional but recommended — it provides venv-cmds list to discover all commands available in the venv and venv-cmds check_updates to check for new releases.

Quick start

# Bootstrap in one step
cred-client quickstart https://credserver.internal my-client

# Fetch a credential (JSON printed to stdout)
cred-client fetch my-database-password

# Check all credentials mapped in .cred.env
cred-client check --all

# Diagnose config and connectivity
cred-client doctor

Configuration

Settings are stored in .cred.env (mode 600).

Additional keys in .cred.env are treated as credential name mappings used by check --all — each key maps an environment variable name to a credential name on the server.

CLI reference

cred-client quickstart <server_url> <client_name> [--deployment-ref ...]
cred-client fetch {--name <n>|--var <VAR>}
cred-client register <name> [deployment_ref]
cred-client update [--deployment-ref ...]
cred-client set {server|ca-cert|token} <value>
cred-client download ca-cert
cred-client import --input-file <file> [--name <n>] [--var <VAR>] [--description ...] [--overwrite]
cred-client check {--all|--var <VAR>|--name <name>} [--verbose]
cred-client info
cred-client rotate-token
cred-client doctor

fetch

import

Uploads a JSON file as a credential on the server. The credential name is resolved from the flags provided:

When --name and --var are both given and <VAR> already exists in .cred.env with a different name, the command refuses with an error. If it already maps to the same name, it proceeds normally.

Add --overwrite to update an existing credential instead of creating a new one (requires can_update on the server-side link).

Python API — Tier 2 clients

from cred_client.core import get_cred

# Reads credential name from the named env var, fetches from server,
# returns the secret as a dict. Calls sys.exit(1) on failure.
db_creds = get_cred("DB_CRED_NAME")
password = db_creds["password"]

Full CRUD:

from cred_client.core import (
    fetch_credential,   # returns secret dict
    create_credential,
    update_credential,
    delete_credential,
)

Server

This client connects to ophix-creds.