# `Wardrik.Keys`

Finds the API keys an agent's code calls services with. Implements `WardrikCore.Keys`.

Keys are secrets in the vault. Wardrik looks in this order:

  1. The person, for a person's agent.
  2. The org.
  3. The deployment.

An org or person brings its own key by sealing a secret with the key's name:

    Wardrik.put_secret(MyApp.AgentRuntime, "acme", "ZAI_API_KEY", key)

If no one holds it, the code finds its own, as ReqLLM reads the environment. Only secrets
count. A connected account is a credential, never a key.

# `owners`

```elixir
@spec owners(WardrikCore.Principal.t() | nil) :: [String.t()]
```

Returns the owners whose keys an agent working for `principal` uses, nearest first.

---

*Consult [api-reference.md](api-reference.md) for complete listing*