@anht3889/dsh-web-search-bundle

Configuration and secrets

Data	Default location
Engine selection and base URLs; no secret values	$DSH_HOME/web-search/config.json
Fallback key storage	$DSH_HOME/web-search/secrets.yaml
Key references	TAVILY_API_KEY, BRAVE_API_KEY

Secret resolution uses the first non-empty value from the mounted ctx.credentials service, the private fallback file, then the process environment. Settings writes keys through ctx.credentials when it is mounted; otherwise it writes the fallback file. The HTTP API and Settings status expose only whether each key is configured, never its value.

If no Host webserver is mounted, the provider still supports headless searches, but the Settings UI and management HTTP routes are unavailable. Configure the same catalog and secret locations before starting that composition.