BYOK. API keys are encrypted at rest; only a secret reference is stored on the credential row.
No credentials yet.