> ## Documentation Index
> Fetch the complete documentation index at: https://docs.evox.wraithesports.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Capability APIs

> Learn the host-controlled key, settings, storage, network, credential and system calls.

| Permission        | Host methods                       | Note                                    |
| ----------------- | ---------------------------------- | --------------------------------------- |
| `key.display`     | title, image, state, success/error | Requires an active binding context      |
| `storage.private` | `storage.get/set/delete`           | Plugin-scoped bounded quota             |
| `network.fetch`   | `network.fetch`                    | Declared HTTPS host/method/byte scope   |
| `secret.manage`   | `secret.has/delete`                | There is no raw getter                  |
| `oauth`           | `oauth.begin/status`               | Token bytes never enter plugin messages |
| `action.invoke`   | `action.invoke`                    | Limited to permitted provider targets   |

<Note>
  **T1 (local dev) vs T2 (public sandbox) — which capability works where:** The host-brokered capabilities that work on the **T1** host today are `key.display` (title / **image** / state / success/error) and `settings.get/patch`. The others (`storage`, `network.fetch`, `secret`, `oauth`, `clipboard`, `profile`, `system`, `input`, `action.invoke`) are for **T2**.

  **T1 is sandboxless Node**, so it does not need host-brokered versions of these — use platform APIs directly: `fetch()` for the network, `node:fs` for files/persistence, and handle your own token/OAuth management directly. The host-brokered versions exist to make your code **portable to T2** (once public upload opens). Details: <a href="/en/sdk/trust-tiers">Trust tiers</a>.
</Note>

## Key display

```js theme={}
await client.setTitle(context.bindingInstanceId, 'Hazır');
await client.showSuccess(context.bindingInstanceId);
```

A static image uses a manifest-hash verified `assetId`; a dynamic image uses a bounded PNG/JPEG/WebP raster descriptor. Raw paths or external URLs are not accepted.

## Credential lifecycle and authenticated fetch

```js theme={}
await client.hasSecret('serviceToken');
await client.beginOAuth('providerName');
await client.networkFetchWithCredential({
  url: 'https://api.example.com/status',
  method: 'GET',
  credential: { kind: 'secret', name: 'serviceToken' }
});
```

A credential reference is only of the form `{kind:'secret',name}` or `{kind:'oauth',provider}`. The host decrypts the secret from its own encrypted vault and injects it into the permitted HTTPS request; the raw credential never enters the plugin request/response. The host still enforces the permission host/method/header/request/response limits.

<Warning>Do not put a raw token in normal settings, a manifest default, a log or a `network.fetch` header.</Warning>