MusterDocs

Credentials

Credentials are exported as MUSTER_CRED_<KEY> environment variables — one per entry in credentials.required[], uppercased. Credentials are never stored in muster.json or committed to git.

Credential modes

Each service can be configured with a credential mode in muster.json or via muster setup.

Modes

NameDescription
off
modeNo credentials loaded.
save
modeStored in OS keychain (macOS Keychain / Linux secret-tool), prompted on first use.
session
modeCached in memory for the session, prompted on first use.
always
modePrompted every time.

Configuration

Enable credentials and list required keys per-service in muster.json:

json
{
  "services": {
    "api": {
      "credentials": {
        "enabled": true,
        "mode": "save",
        "required": ["DATABASE_URL", "API_KEY"]
      }
    }
  }
}

Setup

Running muster setup prompts for the credential mode interactively. For non-interactive use, pass the mode directly:

bash
muster setup --creds api=session

Using credentials in hooks

Inside hook scripts, access credentials via their environment variables:

bash
#!/usr/bin/env bash
set -euo pipefail

# Credentials are available as MUSTER_CRED_<KEY>
echo "Connecting to $MUSTER_CRED_DATABASE_URL"
curl -H "Authorization: Bearer $MUSTER_CRED_API_KEY" https://api.example.com/deploy
Warning
Credentials are never stored in muster.json or committed to git. Never echo or log credential values in your hook scripts.
Health ChecksRemote Deploy