Bitwarden Secrets

Pull your API keys from Bitwarden Secrets Manager every time Hermes starts, instead of keeping them in plain text in ~/.hermes/.env.

One bootstrap secret, a Bitwarden machine-account access token, replaces every per-provider key. Hermes stores it in ~/.hermes/.env as BWS_ACCESS_TOKEN. Each time hermes, the gateway or a cron job starts, after .env loads, Hermes runs bws secret list for your project and sets the returned keys in the environment. By default Bitwarden overrides values already there, so a key you rotate once in the web app reaches every Hermes process on its next start; set override_existing: false if you want .env to win. In the Bitwarden web app, where your normal 2FA applies, you create a project, add secrets whose names become the environment variable names (OPENROUTER_API_KEY), create a machine account with Read access, and copy its access token, which Bitwarden cannot show again. hermes secrets bitwarden setup installs bws if needed, stores the token, asks for your region (US Cloud, EU Cloud or self-hosted), picks the project, test-fetches and turns it on. A fetch result is reused for cache_ttl_seconds (300 by default). An optional encrypted cache of the last good fetch can be used for up to max_stale_seconds, only after network or timeout failures, never after authentication failures. Bitwarden never blocks startup: on failure Hermes prints a one-line warning naming the fix and keeps the keys already in .env.