Module key_validator 

Live API-key validation for the Trust Center.

Each supported service has a probe that makes a single minimal authenticated request and maps the response to non-secret metadata (account name, scopes, etc.). This is the only outbound call the key flow makes, and it fires only on the user’s explicit Validate click (see specs/SPEC_TRUST_CENTER_2026_06_15.md §5.1, §6).

The plaintext key is passed in by value, used to build one request, and never logged. Callers must keep it out of logs/transcripts.

Structs

ValidationOutcome

Outcome of a validation probe. metadata is non-secret JSON safe to persist on the account row + show in the UI; masked_tail is the last few chars for the locked display.

Functions

anthropic 🔒

client 🔒

github 🔒

masked_tail

Masked hint for the locked display: bullet run + last 4 chars. Stored alongside the account so the panel can render ••••••••3f9a without the secret. Keys shorter than 4 chars are fully masked (no tail leak).

openai 🔒

slack 🔒

validate

Validate key for provider. Makes one outbound HTTPS request. Returns a non-valid outcome (never errors the RPC) so the caller can surface a structured message and stay in the entry state.