RECOMMENDED: Make an API call with server-side credential injection. The credential is fetched from the Clavis vault and injected into the upstream request server-side — the raw API key never enters this conversation. Prefer this over get_credentials: it eliminates prompt-injection exfiltration as an attack vector, because there is no secret in context to exfiltrate.

LEGACY — returns raw credential data into this conversation. Prefer call_service for security: call_service injects credentials server-side so the raw API key is never exposed to the model. Use this only when you must hold the token itself (e.g. handing it to a library that cannot be proxied). Clavis handles token refresh and rotation automatically.

List all services configured in Clavis for the authenticated developer.

Check the validity and rate-limit status of credentials for a service without making any external API call. Queries only the Clavis vault (database + Redis). Returns validity, expiry, rate-limit headroom, and last-used timestamp.