# Credentials Configuration

How to configure credentials so the scripts can execute API requests
without exposing tokens to the agent.

## Security Model

```
Agent          scripts/tidbcloud-exec.sh         TiDB Cloud API
(sees JSON) -> (loads creds from env/file)     -> (receives auth)
               Credentials loaded here
               (never returned to agent)
```

The agent only sees:
- Request: `{"method":"GET","path":"/clusters"}`
- Response: `{"status_code":200,"body":{...}}`

## Setup (Recommended)

Create `.env` in the skill directory (`skills/tidbcloud-api/.env`):

```bash
TIDB_PUBLIC_KEY="your-public-key-here"
TIDB_PRIVATE_KEY="your-private-key-here"
TIDBCLOUD_PROJECT_ID="your-project-id-here"

# Starter/Essential defaults
TIDBCLOUD_HOST="serverless.tidbapi.com"
TIDBCLOUD_BASE_PATH="/v1beta1"
TIDBCLOUD_REGION_NAME="regions/aws-us-east-1"
TIDBCLOUD_ROOT_PASSWORD="your-root-password"

# Premium (only needed for --sut tidbx-premium)
# TIDBCLOUD_PREMIUM_HOST="cloud.tidbapi.com"
# TIDBCLOUD_PREMIUM_BASE_PATH="/v1beta2"
# TIDBCLOUD_PREMIUM_REGION_ID="aws-us-east-1"
```

`.env` is auto-loaded by the scripts. Never commit it (already in `.gitignore`).

## Alternative: Environment Variables

```bash
export TIDB_PUBLIC_KEY="your-public-key-here"
export TIDB_PRIVATE_KEY="your-private-key-here"
```

## Alternative: Credential File

Create `~/.tidb-credentials.json`:

```json
{
  "public_key": "your-public-key-here",
  "private_key": "your-private-key-here"
}
```

Set permissions: `chmod 600 ~/.tidb-credentials.json`

## Verification

```bash
scripts/tidbcloud-exec.sh http '{"method":"GET","path":"/clusters"}' --sut tidbx
```

If you see `{"success":false,"error":"...401..."}`, check your credentials.

## Troubleshooting

| Issue | Cause | Solution |
|-------|-------|----------|
| Credentials not found | Env vars not set | Check `echo $TIDB_PUBLIC_KEY` |
| 401 Unauthorized | Keys incorrect or expired | Verify keys in TiDB Cloud console |
| Permission denied on cred file | File permissions too open | `chmod 600 ~/.tidb-credentials.json` |