# Credential Management

> Store and manage Credentials used by the Infuse-IoT Python Tools.

The Infuse-IoT Python tools handles credentials for:

- API Key Storage (for transactions with the Infuse-IoT Cloud endpoints)
- Network keys: For ePacket decryption

The `profile` and `credentials` subcommands manages storage of
secrets for the package.
They are thin wrappers over the Python [keyring](https://pypi.org/project/keyring/) package.

The `profile` subcommand manages API Key Storage and custom tools and definitions.

```bash
> infuse profile --help
usage: infuse profile [-h] <command> ...

Manage Infuse-IoT profiles

options:
  -h, --help  show this help message and exit

profile commands:
  <command>
    list      List profiles
    configure
              Create or update a profile
    set       Set active profile
    dump      Dump profile configuration
```

The `credentials` subcommand now just manages network keys.
It used to manage API Keys but is now deprecated in favour of the newer `profile`

```bash
> infuse credentials --help
usage: infuse credentials [-h] [--api-key API_KEY] [--api-key-print]
                          [--network NETWORK]
                          [--custom-tools CUSTOM_TOOLS]
                          [--custom-definitions CUSTOM_DEFINITIONS]

Manage Infuse-IoT credentials

options:
  -h, --help            show this help message and exit
  --api-key API_KEY     Set Infuse-IoT API key
  --api-key-print       Print Infuse-IoT API key
  --network NETWORK     Load network credentials from file
  --custom-tools CUSTOM_TOOLS
                        Location of custom tools
  --custom-definitions CUSTOM_DEFINITIONS
                        Location of custom definitions
```

<caution>

All arguments (excluding `--network`) are deprecated.

</caution>

## API Key Management

An API key is required to interact with the Infuse-IoT cloud services,
which includes generating the shared secrets required to run
authenticated commands on devices (see
[Embedded Security Model](https://docs.dev.infuse-iot.com/latest/platform/security_model.html#platform-security-model)
).

API Keys can be obtained by signing up for an account in the [Infuse Portal](https://portal.infuse-cloud.io/).
There are two types of API Keys that can be used with the Infuse Python Tools:

- [Personal API Keys](https://portal.infuse-cloud.io/account/api-keys): For the same permissions you have.
- [Service Account Keys](https://portal.infuse-cloud.io/access/service-accounts): Useful for temporary access and/or scoped permissions.

However, these are scoped to a single organisation. As a result, multiple API Keys need to be generated if you access multiple organisations.

To accommodate multiple organisations, you will need to create separate profiles for each organisation using the `profile` subcommand.

```bash
infuse profile configure --name <profile_name> --api-key $API_KEY
```

<note>

Substitute your API key for the $API_KEY variable in the above command.
The API key **MUST NOT** include the `Bearer` prefix.

</note>

<tip>

Profiles can be updated by re-running the command with the same `--name`.

</tip>

To switch between different profiles, use the `infuse profile set --name <profile_name>` command.

To view the current API Key, use the `infuse credentials --api-key-print` argument.

## Network Keys

To decode network encrypted packets, the base network key must be
loaded into the credential manager.
This only needs to be performed once per install.

```bash
infuse credentials --network /path/to/network_key.yaml
```

New network key files can be generated with the `infuse-sdk/scripts/network_key_gen.py` helper script from the embedded SDK.

<tip>

The default network (ID 0) is loaded by default.

</tip>

## Custom Content

The Python Tools come with the included standard set of definitions (for RPCs, TDFs and KV slots), and commands.
However, your project may have and require customised definitions and scripts or tooling.

To avoid the need to setup the Python Tools in a developer mode and edit the Python Tools to integrate support,
the Python tools can import these instead. The `--custom-tools` and
`--custom-definitions` flags can each be used to specify a directory which contains the
corresponding tools and definitions.

They can be added to a given profile with:

```bash
infuse profile --name <profile_name> --custom-definitions /path/to/custom/definitions
infuse profile --name <profile_name> --custom-tools /path/to/custom/tools
```

<note>

Replace `/path/to/custom/definitions` with the path to your project's `west cloudgen` output.
Generally this will be under `workspace/project/generated` e.g. for Infuse-IoT, this is `~/infuse/infuse-sdk/generated`

</note>

<note>

Replace `/path/to/custom/tools` with the path to your project's tools folder.
Typically this will be under `workspace/project/scripts/tools` e.g. for Infuse-IoT, this is `~/infuse/infuse-sdk/scripts/tools`

</note>