cmd:keepassxc-cli

[rod-stuchi]

Hi

I don't know what the behavior should be, but my api_key is configured this way:

cmd:keepassxc-cli show -s -a {atribute} {path_to.kdbx} OpenAI

My question is, each time keeppassxc-cli is called, it prompts you for the password, does cmd: support this (asking for the password)?

[bassamsdata]

I’ve encountered this issue before, and it seems like it fails because it doesn’t prompt for a password. To work around it, I created another database specifically for APIs and assigned a key to it without a password, like this:

cmd:keepassxc-cli show --no-password --k {path-to-key} -a {attribute} {path-to-kdbx} OpenAi

This approach works, but I’d prefer not to have to do it this way. I’m curious about how the 1password example in the README works—does it prompt for a password?

[olimorris]

If you have the 1Password CLI installed it will prompt you once per session for the password. It's been seamless in the last 10 months that I've been using it.

[rod-stuchi]

What about creating a small volume in VeraCrypt for this purpose? and load the key with cat /encrypted_volume/file ?
Would it be a safe approach?

[c-c-k]

Based on the following article:

• https://avaldes.co/2020/01/28/secret-service-keepassxc.html

How about the following (linux only) solution:

• Install freedesktop.org secret service:
  • sudo apt install libsecret-tools
• In KeepassXC:
  • Add a new group to be used by the secret service interface:
    • Groups->New Group->Name: secretservice
  • Enable the secret service interface:
    • Tools->Settings->Secret Service->[v] Enable KeepassXC ...
  • Set group added above as secret service group for the database:
    • Database->Database Security->Secret Service->Expose ... group:->secretservice
  • Double check that the group has been correctly set in:
    • Tools->Settings->Secret Service
  • Add entry for API Key:
    • (secretservice group)->Entries->New Entry:
      • Title: Nvim CodeCompanion Gemini API Key
      • Password: (API KEY)
      • Advanced->Additional attributes->Add:
        • (ATTRIBUTE NAME): API_KEY
        • (ATTRIBUTE VALUE): Gemini
• Add API Key to Gemini adapter:
  • api_key = "cmd: secret-tool lookup API_KEY Gemini",

[c-c-k]

Another option is to use inputsecret and then to manually activate KeepassXC autotype once per session:

local api_key
local get_gemini_api_key = function()
  if not api_key then api_key = vim.fn.inputsecret "Please perform KeepassXC autotype for Gemini API key:" end

  return api_key
end
...
      api_key = get_gemini_api_key,
...

[bassamsdata]

@c-c-k That sounds like a nice solution. What do you mean by "activate KeepassXC autotype"? Are you referring to the autotype feature used for autofilling fields in browsers?

[bassamsdata]

I tried it, but there's an issue: it starts writing the API key in the input but then continue the rest of the API the chat window, so I have to copy it manually. Could you please share where you store the API key in KeePassXC (is it in the password field)? Also, do you use any vim.ui.input plugin wrappers?

Thank you!

[c-c-k]

EDIT: @bassamsdata This is a reply to your first reply.

yes.
A slight drawback is that running nvim from a terminal (KDE Konsole in my case) and pressing the KeepassXC autotype shortcut the entry selection window contains all the entries mapped to *Konsole* so it takes a few more keystrokes to filter the API key entry.

For the moment I've solved it by using a KDE KDialog window with a custom title:

local api_key
local get_gemini_api_key = function()
  if not api_key then
    local handle =
      io.popen [[kdialog --password "Please perform KeepassXC autotype for Gemini API key:" --title "nvim codecompanion gemini api_key"]]
    if handle then
      api_key = handle:read("*a"):gsub("\n", "")
      if api_key == "" then api_key = nil end
    end
  end

  return api_key
end

for GNOME (Ubuntu) equivalents to KDE KDialog would be Zenity or YAD, as they are GTK based they should probably work flawlessly on any other Linux distro (windows too but that would require installing GTK on windows).
The script change is minimal :

...
      io.popen [[zenity ...
...

On the other hand I just noticed that KeepassXC allows linking the password field of one entry to the password field of another entry when cloning an entry which makes the secret service solution seem more convenient.

[c-c-k]

@bassamsdata in regards to the issue in your second reply:
To verify, your autotype field is {PASSWORD}{ENTER}?

[bassamsdata]

Thank you for the info. Yes, it's {PASSWORD}{ENTER}, and I even tried {PASSWORD} alone with the same result. For some reason, though, this issue only occurred with the OpenAI API key. I tested with Groq and Anthropic, and they worked perfectly.

So, I deleted the OpenAI entry and created a new one. I suspect there was an extra newline character when I copied the API key. It works perfectly now with the original code you posted on macOS (wezterm and Neovide gui). Honestly, it's an awesome solution!

Thank you

[c-c-k]

Thanks ☺️