Settings and Keys

AI Providers separates three concerns: shared provider asset configuration, local API key storage, and editor-only preferences. Those layers should be understood separately because the storage and security properties are different.

Layer 1: provider asset

The asset stores shared configuration such as display name, base URL, endpoint behavior, default model, and provider GUID.

Layer 2: local API key storage

Keys are stored in PlayerPrefs, scoped by project hash and provider GUID. That keeps keys out of the asset file, but it does not encrypt them at rest.

public string GetApiKey()
{
    if (!string.IsNullOrWhiteSpace(apiKey)) return apiKey;
    return ProviderApiKeyStorage.GetProviderApiKey(providerGuid);
}

Layer 3: editor preferences

Editor panel preferences live separately in AiProvidersEditorLocalSettings via EditorPrefs. That includes selected provider GUID, prompt preferences, and connection-test UI state.

Security posture

Secrets stay out of the serialized asset files.
Secrets are local to the machine/project combination.
Secrets are not an encrypted vault.
Do not describe this as encrypted or vault-backed storage.

Local key and shared config surface

AI Providers panel with hidden API key and connection test

The shared provider asset fields stay editable while the key remains machine-local and visually masked in the editor.