# Apple iCloud Credential Loading Patterns

Session reference: loading Apple ID credentials from `.env` files for pyicloud-based sync operations.

## `.env` password formats

`.env` files may contain passwords with a `*** ` placeholder prefix:

```
APPLE_ID_PASSWORD=*** Have A Dog With 4 Paws
```

Always strip the leading `*** ` before passing to pyicloud:

```python
raw = line.split('=', 1)[1].strip().strip('"').strip("'")
if raw.startswith('*** '):
    raw = raw[4:]
password = raw
```

## Multiple password keys

The user's `.env` may contain both:
- `APPLE_ID_PASSWORD` — the actual Apple ID password (required for pyicloud)
- `APPLE_APP_PASSWORD` — an app-specific password (will NOT work with pyicloud)

The sync script should try `APPLE_ID_PASSWORD` first, then fall back to `APPLE_APP_PASSWORD` only as a last resort (with clear messaging that app-specific passwords don't work with pyicloud).

## Never inline in shell

Passwords containing quotes, spaces, or `***` placeholders break `export PASS=$(grep ...)` constructions. Always load credentials in Python, not shell one-liners.

## Working credential loader

```python
import os

env_path = os.path.expanduser('~/.hermes/.env')
email = os.environ.get('APPLE_EMAIL')
password = os.environ.get('APPLE_PASSWORD')

if not email or not password:
    if os.path.exists(env_path):
        with open(env_path, 'r') as f:
            for line in f:
                line = line.strip()
                if line.startswith('APPLE_EMAIL=') and not email:
                    email = line.split('=', 1)[1].strip().strip('"').strip("'")
                elif line.startswith('APPLE_ID_PASSWORD=') and not password:
                    raw = line.split('=', 1)[1].strip().strip('"').strip("'")
                    if raw.startswith('*** '): raw = raw[4:]
                    password = raw
                elif line.startswith('APPLE_APP_PASSWORD=') and not password:
                    raw = line.split('=', 1)[1].strip().strip('"').strip("'")
                    if raw.startswith('*** '): raw = raw[4:]
                    password = raw
                    print("WARNING: Using APPLE_APP_PASSWORD — this may not work with pyicloud")

if not email or not password:
    raise RuntimeError("Apple credentials not found. Set APPLE_EMAIL and APPLE_PASSWORD env vars.")
```