> ## Documentation Index
> Fetch the complete documentation index at: https://docs.evox.wraithesports.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Capability APIs

> Learn the host-controlled key, settings, storage, network, credential and system calls.

| Permission | Host methods | Note |
| - | - | - |
| `key.display` | title, image, state, success/error | Requires an active binding context |
| `storage.private` | `storage.get/set/delete` | Plugin-scoped bounded quota |
| `network.fetch` | `network.fetch` | Declared HTTPS host/method/byte scope |
| `secret.manage` | `secret.has/delete` | There is no raw getter |
| `oauth` | `oauth.begin/status` | Token bytes never enter plugin messages |
| `action.invoke` | `action.invoke` | Limited to permitted provider targets |

<Note>
  **T1 (local dev) vs T2 (public sandbox) — which capability works where:** The host-brokered capabilities that work on the **T1** host today are `key.display` (title / **image** / state / success/error) and `settings.get/patch`. The others (`storage`, `network.fetch`, `secret`, `oauth`, `clipboard`, `profile`, `system`, `input`, `action.invoke`) are for **T2**.

  **T1 is sandboxless Node**, so it does not need host-brokered versions of these — use platform APIs directly: `fetch()` for the network, `node:fs` for files/persistence, and handle your own token/OAuth management directly. The host-brokered versions exist to make your code **portable to T2** (once public upload opens). Details: <a href="/en/sdk/trust-tiers">Trust tiers</a>.
</Note>

## Key display

```js theme={}
await client.setTitle(context.bindingInstanceId, 'Hazır');
await client.showSuccess(context.bindingInstanceId);
```

A static image uses a manifest-hash verified `assetId`; a dynamic image uses a bounded PNG/JPEG/WebP raster descriptor. Raw paths or external URLs are not accepted.

## Credential lifecycle and authenticated fetch

```js theme={}
await client.hasSecret('serviceToken');
await client.beginOAuth('providerName');
await client.networkFetchWithCredential({
  url: 'https://api.example.com/status',
  method: 'GET',
  credential: { kind: 'secret', name: 'serviceToken' }
});
```

A credential reference is only of the form `{kind:'secret',name}` or `{kind:'oauth',provider}`. The host decrypts the secret from its own encrypted vault and injects it into the permitted HTTPS request; the raw credential never enters the plugin request/response. The host still enforces the permission host/method/header/request/response limits.

<Warning>Do not put a raw token in normal settings, a manifest default, a log or a `network.fetch` header.</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.