flowleap-keyslisted

# FlowLeap Patent-Data Keys (BYOK) Patent data flows through provider APIs that may need the USER's own credentials: EPO OPS (consumer key + secret — always a pair) and USPTO ODP (single API key). The concept is **patent-data keys**; `provider_keys_required` and `provider_keys_invalid` are the wire codes that name it in error envelopes. Keys live in `credentials.toml` (0600) and are forwarded per-request; the CLI never prints them (verbose/dry-run redact). ## Diagnose ```bash flowleap --json keys list # what's configured locally (masked) flowleap --json keys test # live verdicts: source user|server|none, valid true|false|null flowleap --json doctor # providerKeys section + pending steps in nextSteps ``` `keys test` needing nothing locally is fine when `source` is `server` — the backend has its own keys and commands work without BYOK. Doctor's `nextSteps` lists patent-data keys only when they actually **block** work: server-covered providers produce no steps. A blocking provider appears as an obtain/store pair — `obtain-epo-keys` / `obtain-uspto-key` (`actor: "human"`, carries the signup `url` — relay it to the user) then `store-epo-keys` / `store-uspto-key` (`actor: "agent"`, carries the `run` command — execute it once the user hands you the keys) — followed by `verify-keys` (`actor: "agent"`, runs `keys test`). When doctor cannot reach the validation endpoint (unauthenticated/offline) it falls back to local key presence and says so in `keyValidation.note`. S