librechat-sandbox: per-member key auto-load (portal feed + sync-keys.js), redaction gotcha

maintenance/librechat-sandbox.md

@@ -106,6 +106,29 @@ summary.
   overriding the Tailwind CSS variables on `html.light`/`html.dark`
   (`--surface-primary`, `--accent-primary`, …) from the overlay `custom.css`.
 
+
+## Per-member key auto-load (no API-key prompts)
+
+Members never enter an API key. The portal provisions each member's LiteLLM
+key at onboarding; the sandbox seeds it into LibreChat's user-key store:
+
+- `GET /admin/librechat/keys` on the portal returns active members' chat keys
+  (dedicated `X-Sync-Token` auth — `LIBRECHAT_SYNC_TOKEN` on both apps).
+- `/app/data/sync-keys.js` (in the LibreChat container, mirrored in the repo
+  as `sync-keys.js`) fetches that feed and seeds the `keys` collection
+  (chat endpoint, `apiKey: "user_provided"`) and `pluginauths`
+  (`mcp:inference-image` → `IC_API_KEY`, injected per-user via
+  `customUserVars` so image generation bills to the member's own team).
+- Members without a sandbox account are skipped until they first log in; run
+  the sync after onboarding waves and on a schedule (the command is in the
+  repo README). Idempotent.
+- Encryption matches LibreChat's own (`CREDS_KEY`/`CREDS_IV`, read from
+  `/proc/1/environ` — exec sessions don't inherit the app env).
+
+> Terminal output redacts values after `apiKey:` as `***` even for harmless
+> strings (`user_provided`, `${TTS_API_KEY}`). Probe lengths/counts instead
+> of trusting redacted output.
+
 ## Verification (after any change)
 
 ```bash