How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

fnox-providers - Skill - OpenSmartRoute

Name: fnox-providers
Author: thebushidocollective

Imported from thebushidocollective/han (plugins/specialized/fnox/skills/providers/SKILL.md). Install upstream with npx skills add thebushidocollective/han --skill providers. Copyright stays with the author.

Fnox - Providers

Configuring encryption and secret storage providers in Fnox for secure secrets management.

Provider Types

Fnox supports three categories of providers:

Encryption - Local encryption (age, AWS KMS, Azure, GCP)
Cloud Storage - Remote secret storage (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, Vault)
Password Managers - Integration with password managers (1Password, Bitwarden, Infisical, pass)

Age Encryption (Recommended)

Setup Age Provider

# Generate age key pair
age-keygen -o ~/.config/fnox/keys/identity.txt

# Get public key
cat ~/.config/fnox/keys/identity.txt | grep "public key"
# age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

Configure Age in fnox.toml

# fnox.toml (committed)
[providers.age]
type = "age"
public_keys = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"]

# fnox.local.toml (gitignored)
[providers.age]
identity = "~/.config/fnox/keys/identity.txt"

Store Secrets with Age

# Set encrypted secret
fnox set DATABASE_PASSWORD
# Prompts for value, encrypts with age public key

# Set from command
echo "secret-value" | fnox set API_KEY --provider age

Team Setup with Age

# Multiple recipients for team access
[providers.age]
type = "age"
public_keys = [
  "age1ql3z...",  # Alice
  "age1qw4r...",  # Bob
  "age1qx5t...",  # CI/CD
]

AWS Secrets Manager

Configure AWS Secrets Manager

[providers.aws-sm]
type = "aws-sm"
region = "us-east-1"
# Optional: profile = "production"

Store Secrets in AWS

# Reference AWS secret
fnox set DATABASE_URL --provider aws-sm
# Enter: prod/database-url (AWS secret name)

AWS Secrets Manager Configuration

[secrets]
DATABASE_URL = {
  provider = "aws-sm",
  value = "prod/database-url",
  description = "Production database connection string"
}

API_KEY = {
  provider = "aws-sm",
  value = "prod/api-key"
}

AWS KMS Encryption

Configure AWS KMS

[providers.kms]
type = "aws-kms"
key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
region = "us-east-1"

Use AWS KMS

# Encrypt with KMS
fnox set SECRET_KEY --provider kms

Azure Key Vault

Configure Azure

[providers.azure]
type = "azure-kv"
vault_url = "https://my-vault.vault.azure.net"
# Authentication via Azure CLI or environment variables

Azure Secrets

[secrets]
DATABASE_PASSWORD = {
  provider = "azure",
  value = "database-password",
  description = "Azure Key Vault secret name"
}

GCP Secret Manager

Configure GCP

[providers.gcp]
type = "gcp-sm"
project_id = "my-project"
# Authentication via gcloud or service account

GCP Secrets

[secrets]
API_KEY = {
  provider = "gcp",
  value = "projects/my-project/secrets/api-key/versions/latest"
}

HashiCorp Vault

Configure Vault

[providers.vault]
type = "vault"
address = "https://vault.example.com"
token = { env = "VAULT_TOKEN" }  # From environment

Vault Secrets

[secrets]
DATABASE_URL = {
  provider = "vault",
  value = "secret/data/prod/database-url"
}

1Password

Configure 1Password

[providers.onepassword]
type = "1password"
# Requires 1Password CLI (op) installed

1Password References

[secrets]
API_KEY = {
  provider = "onepassword",
  value = "op://Production/API Keys/api-key"
}

DATABASE_PASSWORD = {
  provider = "onepassword",
  value = "op://Production/Database/password"
}

Bitwarden

Configure Bitwarden

[providers.bitwarden]
type = "bitwarden"
# Requires Bitwarden CLI (bw) installed and unlocked

Bitwarden Secrets

[secrets]
STRIPE_KEY = {
  provider = "bitwarden",
  value = "item-id/field-name"
}

Provider Testing

Test Provider Configuration

# Test specific provider
fnox provider test age
fnox provider test aws-sm

# List configured providers
fnox provider list

# Add provider interactively
fnox provider add

# Remove provider
fnox provider remove age

Best Practices

Choose the Right Provider

# Development: age (simple, local encryption)
[providers.age]
type = "age"
public_keys = ["age1ql3z..."]

# Production: Cloud secret manager
[providers.aws-sm]
type = "aws-sm"
region = "us-east-1"

# Team collaboration: 1Password or Bitwarden
[providers.onepassword]
type = "1password"

Use Multiple Providers

# Different providers for different secrets
[providers.age]
type = "age"
public_keys = ["age1ql3z..."]

[providers.aws-sm]
type = "aws-sm"
region = "us-east-1"

[secrets]
# Development secrets with age
DEV_API_KEY = { provider = "age", value = "age[...]" }

# Production secrets with AWS
PROD_DATABASE_URL = { provider = "aws-sm", value = "prod/db-url" }

Provider Aliases

# Name providers descriptively
[providers.prod-secrets]
type = "aws-sm"
region = "us-east-1"

[providers.staging-secrets]
type = "aws-sm"
region = "us-west-2"

[secrets]
DATABASE_URL = { provider = "prod-secrets", value = "prod/db" }

Common Patterns

Development to Production Migration

# fnox.toml (development)
[providers.age]
type = "age"
public_keys = ["age1ql3z..."]

[secrets]
DATABASE_URL = { provider = "age", value = "age[...]" }

# fnox.production.toml
[providers.aws-sm]
type = "aws-sm"
region = "us-east-1"

[secrets]
DATABASE_URL = { provider = "aws-sm", value = "prod/database-url" }

Multi-Region Setup

[providers.us-secrets]
type = "aws-sm"
region = "us-east-1"

[providers.eu-secrets]
type = "aws-sm"
region = "eu-west-1"

[secrets]
US_API_ENDPOINT = { provider = "us-secrets", value = "us/api-endpoint" }
EU_API_ENDPOINT = { provider = "eu-secrets", value = "eu/api-endpoint" }

Hybrid Approach

# Development secrets: age encryption
[providers.age]
type = "age"
public_keys = ["age1ql3z..."]

# Shared team secrets: 1Password
[providers.team]
type = "1password"

# Production secrets: AWS
[providers.prod]
type = "aws-sm"
region = "us-east-1"

[secrets]
DEV_DATABASE_URL = { provider = "age", value = "age[...]" }
TEAM_SLACK_WEBHOOK = { provider = "team", value = "op://Team/Slack/webhook" }
PROD_DATABASE_URL = { provider = "prod", value = "prod/db-url" }

Anti-Patterns

Don't Hardcode Credentials

# Bad: Hardcoded credentials
[providers.aws-sm]
type = "aws-sm"
region = "us-east-1"
access_key_id = "[REDACTED aws-access-key]"  # NEVER DO THIS
secret_access_key = "wJalrXUtnFEMI/..."  # NEVER DO THIS

# Good: Use AWS credentials chain
[providers.aws-sm]
type = "aws-sm"
region = "us-east-1"
# Credentials from ~/.aws/credentials or environment

Don't Mix Provider Types Unnecessarily

# Bad: Too many providers for simple project
[providers.age]
type = "age"

[providers.aws-sm]
type = "aws-sm"

[providers.azure]
type = "azure-kv"

[providers.gcp]
type = "gcp-sm"

# Good: Choose one appropriate provider
[providers.age]
type = "age"
public_keys = ["age1ql3z..."]

Don't Share Private Keys

# Bad: Private key in config
[providers.age]
identity = "AGE-SECRET-KEY-..."  # NEVER COMMIT THIS

# Good: Reference external file
[providers.age]
identity = "~/.config/fnox/keys/identity.txt"  # Gitignored

Provider-Specific Features

Age: Multiple Recipients

[providers.age]
type = "age"
public_keys = [
  "age1ql3z...",  # Team member 1
  "age1qw4r...",  # Team member 2
  "age1qx5t...",  # CI/CD system
]

AWS: Cross-Account Access

[providers.shared-secrets]
type = "aws-sm"
region = "us-east-1"
role_arn = "arn:aws:iam::123456789012:role/CrossAccountSecretsRole"

Vault: Namespace Support

[providers.vault-prod]
type = "vault"
address = "https://vault.example.com"
namespace = "production"
token = { env = "VAULT_TOKEN" }

Related Skills

configuration: Managing fnox.toml structure and secrets
security-best-practices: Security guidelines for providers

Install fnox-providers and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "thebushidocollective-han-providers", "kind": "skill", "name": "fnox-providers", "description": "Use when configuring Fnox providers for encryption and secret storage. Covers age encryption, cloud providers (AWS, Azure, GCP), and password managers.", "publisher": "thebushidocollective", "version": "1.0.0", "capabilities": { "domains": [ "coding" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Use when configuring Fnox providers for encryption and secret storage. Covers age encryption, cloud providers (AWS, Azure, GCP), and password managers." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/thebushidocollective/han", "path": "plugins/specialized/fnox/skills/providers/SKILL.md", "ref": "HEAD", "url": "https://github.com/thebushidocollective/han/blob/HEAD/plugins/specialized/fnox/skills/providers/SKILL.md", "key": "thebushidocollective/han/plugins/specialized/fnox/skills/providers/SKILL.md" }, "allowed_tools": [ "Read", "Write", "Edit", "Bash", "Grep", "Glob" ] }, "instructions": "# Fnox - Providers\n\nConfiguring encryption and secret storage providers in Fnox for secure secrets management.\n\n## Provider Types\n\nFnox supports three categories of providers:\n\n1. **Encryption** - Local encryption (age, AWS KMS, Azure, GCP)\n2. **Cloud Storage** - Remote secret storage (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, Vault)\n3. **Password Managers** - Integration with password managers (1Password, Bitwarden, Infisical, pass)\n\n## Age Encryption (Recommended)\n\n### Setup Age Provider\n\n```bash\n# Generate age key pair\nage-keygen -o ~/.config/fnox/keys/identity.txt\n\n# Get public key\ncat ~/.config/fnox/keys/identity.txt | grep \"public key\"\n# age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p\n```\n\n### Configure Age in fnox.toml\n\n```toml\n# fnox.toml (committed)\n[providers.age]\ntype = \"age\"\npublic_keys = [\"age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p\"]\n\n# fnox.local.toml (gitignored)\n[providers.age]\nidentity = \"~/.config/fnox/keys/identity.txt\"\n```\n\n### Store Secrets with Age\n\n```bash\n# Set encrypted secret\nfnox set DATABASE_PASSWORD\n# Prompts for value, encrypts with age public key\n\n# Set from command\necho \"secret-value\" | fnox set API_KEY --provider age\n```\n\n### Team Setup with Age\n\n```toml\n# Multiple recipients for team access\n[providers.age]\ntype = \"age\"\npublic_keys = [\n \"age1ql3z...\", # Alice\n \"age1qw4r...\", # Bob\n \"age1qx5t...\", # CI/CD\n]\n```\n\n## AWS Secrets Manager\n\n### Configure AWS Secrets Manager\n\n```toml\n[providers.aws-sm]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n# Optional: profile = \"production\"\n```\n\n### Store Secrets in AWS\n\n```bash\n# Reference AWS secret\nfnox set DATABASE_URL --provider aws-sm\n# Enter: prod/database-url (AWS secret name)\n```\n\n### AWS Secrets Manager Configuration\n\n```toml\n[secrets]\nDATABASE_URL = {\n provider = \"aws-sm\",\n value = \"prod/database-url\",\n description = \"Production database connection string\"\n}\n\nAPI_KEY = {\n provider = \"aws-sm\",\n value = \"prod/api-key\"\n}\n```\n\n## AWS KMS Encryption\n\n### Configure AWS KMS\n\n```toml\n[providers.kms]\ntype = \"aws-kms\"\nkey_id = \"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\"\nregion = \"us-east-1\"\n```\n\n### Use AWS KMS\n\n```bash\n# Encrypt with KMS\nfnox set SECRET_KEY --provider kms\n```\n\n## Azure Key Vault\n\n### Configure Azure\n\n```toml\n[providers.azure]\ntype = \"azure-kv\"\nvault_url = \"https://my-vault.vault.azure.net\"\n# Authentication via Azure CLI or environment variables\n```\n\n### Azure Secrets\n\n```toml\n[secrets]\nDATABASE_PASSWORD = {\n provider = \"azure\",\n value = \"database-password\",\n description = \"Azure Key Vault secret name\"\n}\n```\n\n## GCP Secret Manager\n\n### Configure GCP\n\n```toml\n[providers.gcp]\ntype = \"gcp-sm\"\nproject_id = \"my-project\"\n# Authentication via gcloud or service account\n```\n\n### GCP Secrets\n\n```toml\n[secrets]\nAPI_KEY = {\n provider = \"gcp\",\n value = \"projects/my-project/secrets/api-key/versions/latest\"\n}\n```\n\n## HashiCorp Vault\n\n### Configure Vault\n\n```toml\n[providers.vault]\ntype = \"vault\"\naddress = \"https://vault.example.com\"\ntoken = { env = \"VAULT_TOKEN\" } # From environment\n```\n\n### Vault Secrets\n\n```toml\n[secrets]\nDATABASE_URL = {\n provider = \"vault\",\n value = \"secret/data/prod/database-url\"\n}\n```\n\n## 1Password\n\n### Configure 1Password\n\n```toml\n[providers.onepassword]\ntype = \"1password\"\n# Requires 1Password CLI (op) installed\n```\n\n### 1Password References\n\n```toml\n[secrets]\nAPI_KEY = {\n provider = \"onepassword\",\n value = \"op://Production/API Keys/api-key\"\n}\n\nDATABASE_PASSWORD = {\n provider = \"onepassword\",\n value = \"op://Production/Database/password\"\n}\n```\n\n## Bitwarden\n\n### Configure Bitwarden\n\n```toml\n[providers.bitwarden]\ntype = \"bitwarden\"\n# Requires Bitwarden CLI (bw) installed and unlocked\n```\n\n### Bitwarden Secrets\n\n```toml\n[secrets]\nSTRIPE_KEY = {\n provider = \"bitwarden\",\n value = \"item-id/field-name\"\n}\n```\n\n## Provider Testing\n\n### Test Provider Configuration\n\n```bash\n# Test specific provider\nfnox provider test age\nfnox provider test aws-sm\n\n# List configured providers\nfnox provider list\n\n# Add provider interactively\nfnox provider add\n\n# Remove provider\nfnox provider remove age\n```\n\n## Best Practices\n\n### Choose the Right Provider\n\n```toml\n# Development: age (simple, local encryption)\n[providers.age]\ntype = \"age\"\npublic_keys = [\"age1ql3z...\"]\n\n# Production: Cloud secret manager\n[providers.aws-sm]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n\n# Team collaboration: 1Password or Bitwarden\n[providers.onepassword]\ntype = \"1password\"\n```\n\n### Use Multiple Providers\n\n```toml\n# Different providers for different secrets\n[providers.age]\ntype = \"age\"\npublic_keys = [\"age1ql3z...\"]\n\n[providers.aws-sm]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n\n[secrets]\n# Development secrets with age\nDEV_API_KEY = { provider = \"age\", value = \"age[...]\" }\n\n# Production secrets with AWS\nPROD_DATABASE_URL = { provider = \"aws-sm\", value = \"prod/db-url\" }\n```\n\n### Provider Aliases\n\n```toml\n# Name providers descriptively\n[providers.prod-secrets]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n\n[providers.staging-secrets]\ntype = \"aws-sm\"\nregion = \"us-west-2\"\n\n[secrets]\nDATABASE_URL = { provider = \"prod-secrets\", value = \"prod/db\" }\n```\n\n## Common Patterns\n\n### Development to Production Migration\n\n```toml\n# fnox.toml (development)\n[providers.age]\ntype = \"age\"\npublic_keys = [\"age1ql3z...\"]\n\n[secrets]\nDATABASE_URL = { provider = \"age\", value = \"age[...]\" }\n\n# fnox.production.toml\n[providers.aws-sm]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n\n[secrets]\nDATABASE_URL = { provider = \"aws-sm\", value = \"prod/database-url\" }\n```\n\n### Multi-Region Setup\n\n```toml\n[providers.us-secrets]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n\n[providers.eu-secrets]\ntype = \"aws-sm\"\nregion = \"eu-west-1\"\n\n[secrets]\nUS_API_ENDPOINT = { provider = \"us-secrets\", value = \"us/api-endpoint\" }\nEU_API_ENDPOINT = { provider = \"eu-secrets\", value = \"eu/api-endpoint\" }\n```\n\n### Hybrid Approach\n\n```toml\n# Development secrets: age encryption\n[providers.age]\ntype = \"age\"\npublic_keys = [\"age1ql3z...\"]\n\n# Shared team secrets: 1Password\n[providers.team]\ntype = \"1password\"\n\n# Production secrets: AWS\n[providers.prod]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n\n[secrets]\nDEV_DATABASE_URL = { provider = \"age\", value = \"age[...]\" }\nTEAM_SLACK_WEBHOOK = { provider = \"team\", value = \"op://Team/Slack/webhook\" }\nPROD_DATABASE_URL = { provider = \"prod\", value = \"prod/db-url\" }\n```\n\n## Anti-Patterns\n\n### Don't Hardcode Credentials\n\n```toml\n# Bad: Hardcoded credentials\n[providers.aws-sm]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\naccess_key_id = \"[REDACTED aws-access-key]\" # NEVER DO THIS\nsecret_access_key = \"wJalrXUtnFEMI/...\" # NEVER DO THIS\n\n# Good: Use AWS credentials chain\n[providers.aws-sm]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\n# Credentials from ~/.aws/credentials or environment\n```\n\n### Don't Mix Provider Types Unnecessarily\n\n```toml\n# Bad: Too many providers for simple project\n[providers.age]\ntype = \"age\"\n\n[providers.aws-sm]\ntype = \"aws-sm\"\n\n[providers.azure]\ntype = \"azure-kv\"\n\n[providers.gcp]\ntype = \"gcp-sm\"\n\n# Good: Choose one appropriate provider\n[providers.age]\ntype = \"age\"\npublic_keys = [\"age1ql3z...\"]\n```\n\n### Don't Share Private Keys\n\n```toml\n# Bad: Private key in config\n[providers.age]\nidentity = \"AGE-SECRET-KEY-...\" # NEVER COMMIT THIS\n\n# Good: Reference external file\n[providers.age]\nidentity = \"~/.config/fnox/keys/identity.txt\" # Gitignored\n```\n\n## Provider-Specific Features\n\n### Age: Multiple Recipients\n\n```toml\n[providers.age]\ntype = \"age\"\npublic_keys = [\n \"age1ql3z...\", # Team member 1\n \"age1qw4r...\", # Team member 2\n \"age1qx5t...\", # CI/CD system\n]\n```\n\n### AWS: Cross-Account Access\n\n```toml\n[providers.shared-secrets]\ntype = \"aws-sm\"\nregion = \"us-east-1\"\nrole_arn = \"arn:aws:iam::123456789012:role/CrossAccountSecretsRole\"\n```\n\n### Vault: Namespace Support\n\n```toml\n[providers.vault-prod]\ntype = \"vault\"\naddress = \"https://vault.example.com\"\nnamespace = \"production\"\ntoken = { env = \"VAULT_TOKEN\" }\n```\n\n## Related Skills\n\n- **configuration**: Managing fnox.toml structure and secrets\n- **security-best-practices**: Security guidelines for providers", "cost": { "context_tokens": 2018 } }