README: per-member key auto-load section + redaction gotcha

README.md

@@ -233,6 +233,45 @@ needed.
   `tinfoil/whisper-large-v3-turbo`, both via the gateway with the capped key.
 - **Web search**: SearXNG (self-hosted) + keyless Keenable scraper, no reranker.
 
+
+## Per-member key auto-load (no API-key prompts)
+
+Members never enter an API key. Chat and image generation resolve each
+member's own portal-provisioned key automatically:
+
+1. The portal provisions a per-member LiteLLM key at onboarding and stores it
+   (`members.key_token`).
+2. `GET /admin/librechat/keys` on the portal returns those keys for ACTIVE
+   members — authenticated by the dedicated `X-Sync-Token` header
+   (`LIBRECHAT_SYNC_TOKEN`, set on BOTH apps; not the admin token).
+3. `sync-keys.js` (this repo, deployed to `/app/data/sync-keys.js`) fetches
+   that feed and upserts, per member with a sandbox account:
+   - `keys` collection: `{userId, name: "Inference Co-op", value: encrypt(JSON.stringify({apiKey}))}`
+     — consumed by the chat endpoint (`apiKey: "user_provided"` in the yaml).
+   - `pluginauths` collection: `{userId, pluginKey: "mcp:inference-image",
+     authField: "IC_API_KEY", value: encrypt(key)}` — consumed by the MCP
+     `customUserVars` config so image generation bills to the member's team.
+   Encryption uses LibreChat's own scheme (`CREDS_KEY`/`CREDS_IV`, AES-256-CBC
+   via `@librechat/data-schemas` `encrypt()`), read from the app process env
+   (`/proc/1/environ`) because `cloudron exec` sessions don't inherit it.
+4. Members who haven't logged in to the sandbox yet are skipped; the next
+   run seeds them. Run hourly or nightly:
+
+```bash
+cloudron --server my.inference.coop --token "$CLOUDRON_TOKEN" exec \
+  --app 4023ccbf-d57a-4500-97df-14de9cf3516e \
+  -- bash -c "cd /app/code/librechat/api && node /app/data/sync-keys.js"
+```
+
+Idempotent. Verify with the DB probe: `keys` and `pluginauths` counts should
+equal the number of members who have logged in to the sandbox.
+
+> **Output-redaction gotcha:** terminal output renders values after
+> `apiKey:` as `***` even when the file contains `user_provided` or
+> `${ENV_REF}`. Never conclude a file contains a literal placeholder from
+> redacted output — probe lengths/counts instead
+> (`tr -cd '*' < file | wc -c`, `awk -F'apiKey: ' '{print length($2)}'`).
+
 ## Known state / limitations
 
 - The `[schedules]` Redis guard error is resolved by