Credentials Vault — Secure Per-Project Credentials

When to Use

• Auto-activate: You need a Supabase URL, API key, DB password, token — BEFORE asking the user
• Auto-activate: Authentication error (401, 403, "invalid key", "unauthorized")
• On demand: User provides credentials and wants them saved
• On demand: "what credentials do I have", "show saved keys"

File Locations

Per-project (overrides shared)

~/.claude/projects/{project-path}/credentials.env

{project-path} = project path with / replaced by -, prefixed with -.