diff --git a/docs/superpowers/specs/2026-08-30-openai-transcription-design.md b/docs/superpowers/specs/2026-08-30-openai-transcription-design.md
index 799602f..fcea98e 100644
--- a/docs/superpowers/specs/2026-08-30-openai-transcription-design.md
+++ b/docs/superpowers/specs/2026-08-30-openai-transcription-design.md
@@ -30,6 +30,7 @@ The app uses the transcription endpoint, never the translation endpoint. It send
 
 - `models.py` extends application settings with an optional context/vocabulary string.
 - `services/settings.py` persists the non-secret model, language, output directory, preprocessing values, and context.
+- `services/credentials.py` reads and updates the existing Windows Credential Manager generic credential whose target name is exactly `OPENAI_API_KEY`.
 - `services/job_manifest.py` owns schema validation, atomic manifest writes, resumable state transitions, and transcript assembly.
 - `services/transcription.py` adapts the OpenAI SDK, classifies failures, implements bounded exponential backoff, and orchestrates one request per unfinished chunk.
 - `services/preprocessing.py` creates durable job directories inside the configured output directory and produces chunk records suitable for transcription.
@@ -39,6 +40,12 @@ The app uses the transcription endpoint, never the translation endpoint. It send
 
 Services do not import PySide6. Network calls, retries, waits, manifest I/O, and preprocessing run outside the GUI thread.
 
+## API Credential Integration
+
+The OpenAI API key already exists in Windows Credential Manager under the generic credential target name `OPENAI_API_KEY`. The credential service uses the Windows `keyring` backend's credential lookup for that exact target and accepts the username stored with the matching credential; it does not require or assume the previous `voice-transcriptor` / `openai-api-key` service-account pair.
+
+Saving a replacement key updates the same `OPENAI_API_KEY` target while preserving the credential's existing username when one is available. If no matching credential exists, the settings dialog reports that the API key is not configured and may create the target using `OPENAI_API_KEY` as the stable username. The key is passed directly to the OpenAI client and is never copied into application settings, job manifests, GUI logs, exception messages, or transcript files.
+
 ## Durable Job Layout and Manifest
 
 Every run has a stable directory below `<output_directory>/voice-transcriptor-jobs/<job-id>/`:
@@ -109,7 +116,7 @@ Every chunk transcript retains the preprocessing manifest's exact decimal `sourc
 
 Development follows test-driven cycles. Unit tests use a fake transcription endpoint and deterministic sleeper/random sources; they never require a real API key or network access.
 
-Coverage includes exact SDK arguments and independent chunk calls; Brazilian language/prompt composition; arbitrary model identifiers; retry, rate-limit, exhaustion, and permanent failures; atomic persistence; crash recovery and resume skipping; cancellation; timing retention and ordered concatenation; error sanitization; GUI worker progress; and settings migration/UI behavior.
+Coverage includes exact SDK arguments and independent chunk calls; lookup and update of the exact `OPENAI_API_KEY` Windows credential target; Brazilian language/prompt composition; arbitrary model identifiers; retry, rate-limit, exhaustion, and permanent failures; atomic persistence; crash recovery and resume skipping; cancellation; timing retention and ordered concatenation; error sanitization; GUI worker progress; and settings migration/UI behavior.
 
 Final validation runs the complete pytest suite, Python compilation, whitespace checks, an offscreen GUI startup probe, and an optional local FFmpeg preprocessing smoke test when tools are installed. No live OpenAI request is required for automated validation.