Store server keys and tokens in the OS keychain (macOS Keychain / Windows Credential Manager / Linux Secret Service) — never in localStorage or SQLite, never readable by other apps. Capability: secrets (declared, never prompts).
await window.chatoss.secrets.set('stripe', 'sk_live_…');
const key = await window.chatoss.secrets.get('stripe'); // rejects if unset
await window.chatoss.secrets.delete('stripe');
const names = await window.chatoss.secrets.list(); // names only, never values
Secrets are namespaced per app — another app can't list or read yours.