diff --git a/crates/cloud-providers/src/keystore.rs b/crates/cloud-providers/src/keystore.rs
new file mode 100644
index 0000000..f171878
--- /dev/null
+++ b/crates/cloud-providers/src/keystore.rs
@@ -0,0 +1,14 @@
+/// Store an API key in the OS keychain.
+/// Stub implementation using environment variables until keyring crate is added.
+pub fn store_api_key(provider: &str, key: &str) {
+    std::env::set_var(
+        format!("KON_API_KEY_{}", provider.to_uppercase()),
+        key,
+    );
+}
+
+/// Retrieve an API key from the OS keychain.
+/// Stub implementation using environment variables until keyring crate is added.
+pub fn retrieve_api_key(provider: &str) -> Option<String> {
+    std::env::var(format!("KON_API_KEY_{}", provider.to_uppercase())).ok()
+}
diff --git a/crates/cloud-providers/src/lib.rs b/crates/cloud-providers/src/lib.rs
index dc014ca..a22aff2 100644
--- a/crates/cloud-providers/src/lib.rs
+++ b/crates/cloud-providers/src/lib.rs
@@ -1,2 +1,3 @@
-// kon-cloud-providers: BYOK cloud STT provider implementations
-// and OS keychain API key storage.
+pub mod keystore;
+
+pub use keystore::{retrieve_api_key, store_api_key};