diff --git a/NAMESPACE b/NAMESPACE
index 1e0debf..f149c1d 100644
--- a/NAMESPACE
+++ b/NAMESPACE
@@ -1,11 +1,18 @@
 # Generated by roxygen2: do not edit by hand
 
 export(generate_pkg)
+export(generate_pkg_auth)
+export(generate_pkg_paths)
+export(generate_pkg_req_prepare)
+export(generate_pkg_shared_params)
 export(read_api_abbr)
 export(read_api_definition)
 export(read_api_title)
 export(read_config)
 export(read_rapid_filename)
+export(read_security_data)
+export(read_security_data_filename)
+export(read_security_schemes)
 export(use_beekeeper)
 if (getRversion() < "4.3.0") importFrom("S7", "@")
 importFrom(S7,class_any)
diff --git a/NEWS.md b/NEWS.md
new file mode 100644
index 0000000..167f90c
--- /dev/null
+++ b/NEWS.md
@@ -0,0 +1,3 @@
+# beekeeper 0.4.0.9000
+
+* `generate_pkg_auth()`, `generate_pkg_req_prepare()`, `generate_pkg_paths()`, and `generate_pkg_shared_params()` can now be run one step at a time, with `read_security_schemes()` supporting auth generation (#101).
diff --git a/R/aaa-shared_params.R b/R/aaa-shared_params.R
index f4b5989..9aa76eb 100644
--- a/R/aaa-shared_params.R
+++ b/R/aaa-shared_params.R
@@ -53,6 +53,8 @@
 #' @param rapid_filename (`character(1)` or `fs_path`) The path to the R API
 #'   definition (rapid) file (relative to the package root).
 #' @param required (`logical`) Whether each parameter is required.
+#' @param save_security_data (`logical(1)`) Whether to save generated security
+#'   metadata to a file and record that file in the beekeeper config.
 #' @param security_arg_description (`character(1)`) The argument description.
 #' @param security_arg_name (`character(1)`) The argument name.
 #' @param security_arg_names (`character`) Security argument names to exclude
@@ -71,6 +73,8 @@
 #' @param security_scheme_type (`character(1)`) The security scheme type.
 #' @param security_schemes (`rapid::class_security_schemes`) Security schemes
 #'   from the API definition.
+#' @param security_data_filename (`character(1)` or `fs_path`) The path to the
+#'   saved security metadata file (relative to the package root).
 #' @param tag_operations (`list`) Operations grouped under one tag.
 #' @param tag_name (`character(1)`) The tag name.
 #' @param tags (`character` or `list`) Tags for all operations.
diff --git a/R/generate_pkg-prepare.R b/R/generate_pkg-prepare.R
deleted file mode 100644
index 24dddb9..0000000
--- a/R/generate_pkg-prepare.R
+++ /dev/null
@@ -1,44 +0,0 @@
-#' Generate prepare files
-#'
-#' @inheritParams .shared-params
-#' @returns (`character`) Generated file paths.
-#' @keywords internal
-.generate_prepare <- function(config, api_definition, security_data) {
-  c(
-    .generate_prepare_r(config, api_definition, security_data),
-    .generate_prepare_test(config$api_abbr)
-  )
-}
-
-#' Generate the prepare helper
-#'
-#' @inheritParams .shared-params
-#' @returns (`character(1)`) The generated file path.
-#' @keywords internal
-.generate_prepare_r <- function(config, api_definition, security_data) {
-  .bk_use_template(
-    template = "010-prepare.R",
-    data = list(
-      api_title = config$api_title,
-      api_abbr = config$api_abbr,
-      base_url = api_definition@servers@url,
-      has_security = security_data$has_security,
-      security_arg_helps = security_data$security_arg_helps,
-      security_signature = security_data$security_signature,
-      security_arg_list = security_data$security_arg_list
-    )
-  )
-}
-
-#' Generate prepare tests
-#'
-#' @inheritParams .shared-params
-#' @returns (`character(1)`) The generated test file path.
-#' @keywords internal
-.generate_prepare_test <- function(api_abbr) {
-  .bk_use_template(
-    template = "test-010-prepare.R",
-    dir = "tests/testthat",
-    data = list(api_abbr = api_abbr)
-  )
-}
diff --git a/R/generate_pkg-setup.R b/R/generate_pkg-setup.R
index b960aad..16e2728 100644
--- a/R/generate_pkg-setup.R
+++ b/R/generate_pkg-setup.R
@@ -34,17 +34,53 @@
 #' @returns (`NULL`, invisibly) Called for setup side effects.
 #' @keywords internal
 .setup_r <- function(pkg_dir) {
+  .use_r_directory(pkg_dir)
+  .use_testthat(pkg_dir)
+  .use_httptest2(pkg_dir)
+  .use_nectar(pkg_dir)
+  .use_pkg_beekeeper(pkg_dir)
+}
+
+#' Ensure the R directory exists
+#'
+#' @inheritParams .shared-params
+#' @returns (`NULL`, invisibly) Called for setup side effects.
+#' @keywords internal
+.use_r_directory <- function(pkg_dir) {
   usethis::with_project(
     pkg_dir,
-    {
-      usethis::use_directory("R")
-      withr::with_options(list(usethis.quiet = TRUE), usethis::use_testthat())
-      purrr::quietly(httptest2::use_httptest2)()
-    },
+    usethis::use_directory("R"),
     quiet = TRUE
   )
-  .use_package("nectar", "Imports", pkg_dir)
-  .use_package("beekeeper", "Suggests", pkg_dir)
+  invisible(NULL)
+}
+
+#' Ensure testthat is configured
+#'
+#' @inheritParams .shared-params
+#' @returns (`NULL`, invisibly) Called for setup side effects.
+#' @keywords internal
+.use_testthat <- function(pkg_dir) {
+  usethis::with_project(
+    pkg_dir,
+    withr::with_options(list(usethis.quiet = TRUE), usethis::use_testthat()),
+    quiet = TRUE
+  )
+  invisible(NULL)
+}
+
+#' Ensure httptest2 is configured
+#'
+#' @inheritParams .shared-params
+#' @returns (`NULL`, invisibly) Called for setup side effects.
+#' @keywords internal
+.use_httptest2 <- function(pkg_dir) {
+  usethis::with_project(
+    pkg_dir,
+    purrr::quietly(httptest2::use_httptest2)(),
+    quiet = TRUE
+  )
+  invisible(NULL)
 }
 
 #' Add a package dependency to the DESCRIPTION file
@@ -66,6 +102,24 @@
   invisible(pkg)
 }
 
+#' Add nectar to imports
+#'
+#' @inheritParams .shared-params
+#' @returns (`character(1)`, invisibly) The package name.
+#' @keywords internal
+.use_nectar <- function(pkg_dir = ".") {
+  .use_package("nectar", "Imports", pkg_dir)
+}
+
+#' Add beekeeper to suggests
+#'
+#' @inheritParams .shared-params
+#' @returns (`character(1)`, invisibly) The package name.
+#' @keywords internal
+.use_pkg_beekeeper <- function(pkg_dir = ".") {
+  .use_package("beekeeper", "Suggests", pkg_dir)
+}
+
 #' Add stbl to dependencies if needed
 #'
 #' @inheritParams .shared-params
diff --git a/R/generate_pkg-shared.R b/R/generate_pkg-shared.R
deleted file mode 100644
index 6d89be2..0000000
--- a/R/generate_pkg-shared.R
+++ /dev/null
@@ -1,15 +0,0 @@
-#' Generate shared parameter docs
-#'
-#' @inheritParams .shared-params
-#' @returns (`character(1)`) The generated file path.
-#' @keywords internal
-.generate_shared_params <- function(security_data) {
-  shared_file_path <- .bk_use_template(
-    template = "000-shared.R",
-    data = list(
-      shared_arg_helps = list(),
-      security_arg_helps = security_data$security_arg_helps
-    )
-  )
-  return(shared_file_path)
-}
diff --git a/R/generate_pkg.R b/R/generate_pkg.R
index c95c37b..e2d95af 100644
--- a/R/generate_pkg.R
+++ b/R/generate_pkg.R
@@ -22,41 +22,37 @@ generate_pkg <- function(
   # if not, letting them know that this can be destructive. Skip this check in
   # tests.
   .assert_is_pkg(pkg_dir)
-  api_abbr <- stbl::stabilize_character_scalar(api_abbr)
-  api_title <- stbl::stabilize_character_scalar(api_title)
-  config <- list(api_abbr = api_abbr, api_title = api_title)
-  security_data <- .generate_security(
-    api_abbr,
-    api_definition@components@security_schemes
+  api_abbr <- stbl::stabilize_chr_scalar(api_abbr)
+  api_title <- stbl::stabilize_chr_scalar(api_title)
+  save_security_data <- fs::file_exists(fs::path(pkg_dir, config_filename))
+  security_data <- generate_pkg_auth(
+    api_abbr = api_abbr,
+    security_schemes = api_definition@components@security_schemes,
+    save_security_data = save_security_data,
+    config_filename = config_filename,
+    pkg_dir = pkg_dir
   )
-  security_arg_names <- security_data$security_arg_names %|0|% character()
-  .setup_r(pkg_dir)
-  .maybe_use_stbl(pkg_dir, api_definition@paths, security_arg_names)
-  touched_files <- .generate_pkg_impl(config, api_definition, security_data)
-  return(invisible(touched_files))
-}
-
-#' Generate package files from prepared inputs
-#'
-#' @inheritParams .shared-params
-#' @returns (`character`, invisibly) Generated file paths.
-#' @keywords internal
-.generate_pkg_impl <- function(config, api_definition, security_data) {
-  prep_files <- .generate_prepare(config, api_definition, security_data)
-  pagination_data <- .generate_pagination()
-  path_files <- .generate_paths(
-    paths = api_definition@paths,
-    api_abbr = config$api_abbr,
+  shared_file_path <- generate_pkg_shared_params(
+    security_data = security_data,
+    pkg_dir = pkg_dir
+  )
+  prep_files <- generate_pkg_req_prepare(
+    api_abbr = api_abbr,
+    api_definition = api_definition,
+    api_title = api_title,
+    security_data = security_data,
+    pkg_dir = pkg_dir
+  )
+  path_files <- generate_pkg_paths(
+    api_abbr = api_abbr,
+    api_definition = api_definition,
     security_data = security_data,
-    pagination_data = pagination_data,
-    base_url = api_definition@servers@url
+    pkg_dir = pkg_dir
   )
-  shared_file_path <- .generate_shared_params(security_data)
   touched_files <- c(
     shared_file_path,
     prep_files,
     security_data$security_file_path,
-    pagination_data$pagination_file_path,
     path_files
   )
   return(invisible(touched_files))
diff --git a/R/generate_pkg-security.R b/R/generate_pkg_auth.R
similarity index 69%
rename from R/generate_pkg-security.R
rename to R/generate_pkg_auth.R
index c872edd..e606917 100644
--- a/R/generate_pkg-security.R
+++ b/R/generate_pkg_auth.R
@@ -1,3 +1,47 @@
+#' Generate authentication helpers
+#'
+#' Generate the authentication helper file for a package under development from
+#' the API security schemes stored in the OpenAPI definition. This supports
+#' incremental package scaffolding when you want to review or customize auth
+#' handling before generating the rest of the package files.
+#'
+#' When `save_security_data` is `TRUE`, the generated security metadata is saved
+#' to `security_data_filename` and that filename is recorded in the beekeeper
+#' config so later generation steps can reuse it.
+#'
+#' @inheritParams .shared-params
+#' @returns (`list`) Generated security metadata.
+#' @export
+generate_pkg_auth <- function(
+  api_abbr = read_api_abbr(pkg_dir, config_filename),
+  security_schemes = read_security_schemes(
+    pkg_dir,
+    read_rapid_filename(pkg_dir, config_filename)
+  ),
+  save_security_data = TRUE,
+  security_data_filename = "_beekeeper_security.yml",
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+) {
+  .assert_is_pkg(pkg_dir)
+  api_abbr <- stbl::stabilize_chr_scalar(api_abbr)
+  save_security_data <- stbl::to_lgl_scalar(save_security_data)
+  security_data_filename <- stbl::stabilize_chr_scalar(security_data_filename)
+  .use_r_directory(pkg_dir)
+  .use_nectar(pkg_dir)
+  .use_pkg_beekeeper(pkg_dir)
+  security_data <- .generate_security(api_abbr, security_schemes)
+  if (save_security_data) {
+    .write_security_data(
+      .without_security_file_path(security_data),
+      security_data_filename,
+      config_filename,
+      pkg_dir
+    )
+  }
+  return(security_data)
+}
+
 #' Generate security files and metadata
 #'
 #' @inheritParams .shared-params
@@ -18,6 +62,59 @@
   return(security_data)
 }
 
+#' Write saved security metadata and update the config
+#'
+#' @inheritParams .shared-params
+#' @returns (`character(1)`) The saved security metadata filename.
+#' @keywords internal
+.write_security_data <- function(
+  security_data,
+  security_data_filename,
+  config_filename,
+  pkg_dir
+) {
+  yaml::write_yaml(
+    security_data,
+    file = fs::path(pkg_dir, security_data_filename)
+  )
+  usethis::with_project(
+    pkg_dir,
+    usethis::use_build_ignore(security_data_filename)
+  )
+  .write_config_field(
+    field = "security_data_filename",
+    value = security_data_filename,
+    config_filename = config_filename,
+    pkg_dir = pkg_dir
+  )
+  return(security_data_filename)
+}
+
+#' Update one config field
+#'
+#' @inheritParams .shared-params
+#' @param field (`character(1)`) The config field to write.
+#' @param value (`character(1)`) The value to write.
+#' @returns (`character(1)`) The written config filename.
+#' @keywords internal
+.write_config_field <- function(field, value, config_filename, pkg_dir) {
+  config <- yaml::read_yaml(fs::path(pkg_dir, config_filename))
+  config[[field]] <- value
+  yaml::write_yaml(config, file = fs::path(pkg_dir, config_filename))
+  memoise::forget(read_config)
+  usethis::with_project(pkg_dir, usethis::use_build_ignore(config_filename))
+  return(config_filename)
+}
+
+#' Remove generated file paths from saved security metadata
+#'
+#' @inheritParams .shared-params
+#' @returns (`list`) Security metadata suitable for serialization.
+#' @keywords internal
+.without_security_file_path <- function(security_data) {
+  security_data[names(security_data) != "security_file_path"]
+}
+
 #' Generate a security argument signature
 #'
 #' @inheritParams .shared-params
diff --git a/R/generate_pkg-paths.R b/R/generate_pkg_paths.R
similarity index 91%
rename from R/generate_pkg-paths.R
rename to R/generate_pkg_paths.R
index d08c9af..d021683 100644
--- a/R/generate_pkg-paths.R
+++ b/R/generate_pkg_paths.R
@@ -1,3 +1,44 @@
+#' Generate files for API paths
+#'
+#' Generate operation functions and their tests from the API paths stored in the
+#' OpenAPI definition. This is useful when you want to scaffold endpoint
+#' wrappers separately from the auth, request-preparation, or shared-parameter
+#' steps.
+#'
+#' The generated files include one or more `paths-*.R` files plus any required
+#' test helpers under `tests/testthat/`.
+#'
+#' @inheritParams .shared-params
+#' @returns (`character`) Generated file paths.
+#' @export
+generate_pkg_paths <- function(
+  api_abbr = read_api_abbr(pkg_dir, config_filename),
+  api_definition = read_api_definition(
+    pkg_dir,
+    read_rapid_filename(pkg_dir, config_filename)
+  ),
+  security_data = read_security_data(pkg_dir, config_filename),
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+) {
+  .assert_is_pkg(pkg_dir)
+  api_abbr <- stbl::stabilize_chr_scalar(api_abbr)
+  .use_r_directory(pkg_dir)
+  .use_testthat(pkg_dir)
+  .use_httptest2(pkg_dir)
+  .use_nectar(pkg_dir)
+  .use_pkg_beekeeper(pkg_dir)
+  security_arg_names <- security_data$security_arg_names %|0|% character()
+  .maybe_use_stbl(pkg_dir, api_definition@paths, security_arg_names)
+  .generate_paths(
+    paths = api_definition@paths,
+    api_abbr = api_abbr,
+    security_data = security_data,
+    pagination_data = .generate_pagination(),
+    base_url = api_definition@servers@url
+  )
+}
+
 #' Generate files for API paths
 #'
 #' @inheritParams .shared-params
diff --git a/R/generate_pkg_req_prepare.R b/R/generate_pkg_req_prepare.R
new file mode 100644
index 0000000..87658ab
--- /dev/null
+++ b/R/generate_pkg_req_prepare.R
@@ -0,0 +1,82 @@
+#' Generate request-prepare helpers
+#'
+#' Generate the `*_req_prepare()` helper and its initial test file for a package
+#' under development. This scaffolds the central request-construction helper
+#' used by generated endpoint wrappers, allowing you to inspect or customize it
+#' before generating path functions.
+#'
+#' Saved security metadata from [generate_pkg_auth()] is used, when available,
+#' to include auth parameters in the generated request helper.
+#'
+#' @inheritParams .shared-params
+#' @returns (`character`) Generated file paths.
+#' @export
+generate_pkg_req_prepare <- function(
+  api_abbr = read_api_abbr(pkg_dir, config_filename),
+  api_definition = read_api_definition(
+    pkg_dir,
+    read_rapid_filename(pkg_dir, config_filename)
+  ),
+  api_title = read_api_title(pkg_dir, config_filename),
+  security_data = read_security_data(pkg_dir, config_filename),
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+) {
+  .assert_is_pkg(pkg_dir)
+  api_abbr <- stbl::stabilize_chr_scalar(api_abbr)
+  api_title <- stbl::stabilize_chr_scalar(api_title)
+  .use_r_directory(pkg_dir)
+  .use_testthat(pkg_dir)
+  .use_nectar(pkg_dir)
+  .use_pkg_beekeeper(pkg_dir)
+  .generate_prepare(
+    config = list(api_abbr = api_abbr, api_title = api_title),
+    api_definition = api_definition,
+    security_data = security_data
+  )
+}
+
+#' Generate prepare files
+#'
+#' @inheritParams .shared-params
+#' @returns (`character`) Generated file paths.
+#' @keywords internal
+.generate_prepare <- function(config, api_definition, security_data) {
+  c(
+    .generate_prepare_r(config, api_definition, security_data),
+    .generate_prepare_test(config$api_abbr)
+  )
+}
+
+#' Generate the prepare helper
+#'
+#' @inheritParams .shared-params
+#' @returns (`character(1)`) The generated file path.
+#' @keywords internal
+.generate_prepare_r <- function(config, api_definition, security_data) {
+  .bk_use_template(
+    template = "010-prepare.R",
+    data = list(
+      api_title = config$api_title,
+      api_abbr = config$api_abbr,
+      base_url = api_definition@servers@url,
+      has_security = security_data$has_security,
+      security_arg_helps = security_data$security_arg_helps,
+      security_signature = security_data$security_signature,
+      security_arg_list = security_data$security_arg_list
+    )
+  )
+}
+
+#' Generate prepare tests
+#'
+#' @inheritParams .shared-params
+#' @returns (`character(1)`) The generated test file path.
+#' @keywords internal
+.generate_prepare_test <- function(api_abbr) {
+  .bk_use_template(
+    template = "test-010-prepare.R",
+    dir = "tests/testthat",
+    data = list(api_abbr = api_abbr)
+  )
+}
diff --git a/R/generate_pkg_shared.R b/R/generate_pkg_shared.R
new file mode 100644
index 0000000..0b35b84
--- /dev/null
+++ b/R/generate_pkg_shared.R
@@ -0,0 +1,39 @@
+#' Generate shared parameter docs
+#'
+#' Generate the shared roxygen parameter definitions used across scaffolded
+#' functions. This lets you regenerate or customize the shared parameter topic
+#' independently while iterating on the rest of the generated package files.
+#'
+#' Saved security metadata from [generate_pkg_auth()] is used, when available,
+#' to include auth-related shared parameter documentation.
+#'
+#' @inheritParams .shared-params
+#' @returns (`character(1)`) The generated file path.
+#' @export
+generate_pkg_shared_params <- function(
+  security_data = read_security_data(pkg_dir, config_filename),
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+) {
+  .assert_is_pkg(pkg_dir)
+  .use_r_directory(pkg_dir)
+  .use_nectar(pkg_dir)
+  .use_pkg_beekeeper(pkg_dir)
+  .generate_shared_params(security_data)
+}
+
+#' Generate shared parameter docs
+#'
+#' @inheritParams .shared-params
+#' @returns (`character(1)`) The generated file path.
+#' @keywords internal
+.generate_shared_params <- function(security_data) {
+  shared_file_path <- .bk_use_template(
+    template = "000-shared.R",
+    data = list(
+      shared_arg_helps = list(),
+      security_arg_helps = security_data$security_arg_helps
+    )
+  )
+  return(shared_file_path)
+}
diff --git a/R/read_config.R b/R/read_config.R
index c63e895..601dfa0 100644
--- a/R/read_config.R
+++ b/R/read_config.R
@@ -1,6 +1,6 @@
 #' Read a beekeeper config file
 #'
-#' Reads a YAML file (default name `_beekeeper.yml`) with configuration
+#' Read a YAML file (default name `_beekeeper.yml`) with configuration
 #' information about the API and the package. This file is generated by
 #' [use_beekeeper()], or can be created manually.
 #'
@@ -17,10 +17,13 @@
 #' on an OpenAPI definition file.
 #' - `updated_on` (`character(1)`): A timestamp of when the API definition was
 #' last updated, in the format "YYYY-MM-DD HH:MM:SS" (UTC).
+#' - `security_data_filename` (`character(1)`): Optionally, the path (relative
+#' to the package root) where generated security metadata is stored.
 #'
 #' @inheritParams .shared-params
 #' @returns (`list`) Configuration information, with elements `api_title`,
-#'   `api_abbr`, `api_version`, `rapid_filename`, and `updated_on`.
+#'   `api_abbr`, `api_version`, `rapid_filename`, and `updated_on`, plus
+#'   `security_data_filename` when present.
 #' @export
 #' @family config readers
 read_config <- function(pkg_dir = ".", config_filename = "_beekeeper.yml") {
@@ -35,26 +38,39 @@ read_config <- function(pkg_dir = ".", config_filename = "_beekeeper.yml") {
 #' @returns (`list`) A stabilized config list.
 #' @keywords internal
 .stabilize_config <- function(config) {
-  config$api_title <- stbl::stabilize_character_scalar(config$api_title)
-  config$api_abbr <- stbl::stabilize_character_scalar(config$api_abbr)
-  config$api_version <- stbl::stabilize_character_scalar(
+  config$api_title <- stbl::stabilize_chr_scalar(config$api_title)
+  config$api_abbr <- stbl::stabilize_chr_scalar(config$api_abbr)
+  config$api_version <- stbl::stabilize_chr_scalar(
     config$api_version,
     allow_null = TRUE
   )
-  config$rapid_filename <- stbl::stabilize_character_scalar(
-    config$rapid_filename
-  )
+  config$rapid_filename <- stbl::stabilize_chr_scalar(config$rapid_filename)
   config$updated_on <- config$updated_on %&&%
     strptime(
       config$updated_on,
       format = "%Y-%m-%d %H:%M:%S",
       tz = "UTC"
     )
+  if ("security_data_filename" %in% names(config)) {
+    config$security_data_filename <- stbl::stabilize_chr_scalar(
+      config$security_data_filename
+    )
+  }
   return(config)
 }
 
-.read_config_field <- function(field, pkg_dir, config_filename) {
-  read_config(pkg_dir, config_filename)[[field]]
+.read_config_field <- function(
+  field,
+  pkg_dir,
+  config_filename,
+  default = NULL
+) {
+  pkg_dir <- fs::path_abs(pkg_dir)
+  config <- read_config(pkg_dir, config_filename)
+  if (field %in% names(config)) {
+    return(config[[field]])
+  }
+  default
 }
 
 #' Read rapid_filename config field
@@ -117,9 +133,35 @@ read_api_title <- function(pkg_dir = ".", config_filename = "_beekeeper.yml") {
   .read_config_field("api_title", pkg_dir, config_filename)
 }
 
+#' Read saved security metadata filename
+#'
+#' Read the `security_data_filename` field from a beekeeper config file.
+#'
+#' @inheritParams .shared-params
+#'
+#' @returns (`character(1)`) The configured security metadata file path.
+#' @export
+#' @family config readers
+#' @examples
+#' read_security_data_filename(
+#'   pkg_dir = fs::path_package("beekeeper"),
+#'   config_filename = "example_config.yml"
+#' )
+read_security_data_filename <- function(
+  pkg_dir = ".",
+  config_filename = "_beekeeper.yml"
+) {
+  .read_config_field(
+    "security_data_filename",
+    pkg_dir,
+    config_filename,
+    default = "_beekeeper_security.yml"
+  )
+}
+
 #' Read an API definition file
 #'
-#' Reads an RDS file (default name `_beekeeper_rapid.rds`) with the API
+#' Read an RDS file (default name `_beekeeper_rapid.rds`) with the API
 #' definition stored as a [rapid::class_rapid()] object. This file is generated
 #' by [use_beekeeper()] based on an OpenAPI definition file.
 #'
@@ -138,6 +180,55 @@ read_api_definition <- function(
   pkg_dir = ".",
   rapid_filename = read_rapid_filename(pkg_dir)
 ) {
+  pkg_dir <- fs::path_abs(pkg_dir)
   .assert_is_pkg(pkg_dir)
   readRDS(fs::path(pkg_dir, rapid_filename))
 }
+
+#' Read security schemes from an API definition
+#'
+#' Read the security schemes from an API definition stored as a
+#' [rapid::class_rapid()] object.
+#'
+#' @inheritParams .shared-params
+#' @returns (`rapid::class_security_schemes`) Security schemes from the API
+#'   definition.
+#' @export
+#' @family config readers
+read_security_schemes <- function(
+  pkg_dir = ".",
+  rapid_filename = read_rapid_filename(pkg_dir)
+) {
+  read_api_definition(pkg_dir, rapid_filename)@components@security_schemes
+}
+
+#' Read saved security metadata
+#'
+#' Read prepared security metadata from a YAML file (default name
+#' `_beekeeper_security.yml`) generated via [generate_pkg_auth()].
+#'
+#' @inheritParams .shared-params
+#' @returns (`list`) Saved security metadata.
+#' @export
+#' @family config readers
+#' @examples
+#' read_security_data(
+#'   pkg_dir = fs::path_package("beekeeper"),
+#'   config_filename = "example_config.yml"
+#' )
+read_security_data <- function(
+  pkg_dir = ".",
+  config_filename = "_beekeeper.yml",
+  security_data_filename = read_security_data_filename(
+    pkg_dir,
+    config_filename
+  )
+) {
+  pkg_dir <- fs::path_abs(pkg_dir)
+  .assert_is_pkg(pkg_dir)
+  security_data <- yaml::read_yaml(fs::path(pkg_dir, security_data_filename))
+  if (is.null(security_data)) {
+    return(list())
+  }
+  security_data
+}
diff --git a/R/use_beekeeper.R b/R/use_beekeeper.R
index 04be554..8a27554 100644
--- a/R/use_beekeeper.R
+++ b/R/use_beekeeper.R
@@ -45,7 +45,7 @@ use_beekeeper <- function(
 #' @returns (`character(1)`) The written file path.
 #' @keywords internal
 .write_rapid <- function(api_definition, rapid_filename, pkg_dir) {
-  rapid_filename <- stbl::stabilize_character_scalar(rapid_filename)
+  rapid_filename <- stbl::stabilize_chr_scalar(rapid_filename)
   saveRDS(api_definition, fs::path(pkg_dir, rapid_filename))
   usethis::with_project(pkg_dir, usethis::use_build_ignore(rapid_filename))
   return(rapid_filename)
@@ -63,12 +63,12 @@ use_beekeeper <- function(
   config_filename,
   pkg_dir
 ) {
-  config_filename <- stbl::stabilize_character_scalar(config_filename)
+  config_filename <- stbl::stabilize_chr_scalar(config_filename)
   update_time <- strptime(Sys.time(), format = "%Y-%m-%d %H:%M:%S", tz = "UTC")
   yaml::write_yaml(
     list(
       api_title = api_definition@info@title,
-      api_abbr = stbl::stabilize_character_scalar(api_abbr),
+      api_abbr = stbl::stabilize_chr_scalar(api_abbr),
       api_version = api_definition@info@version,
       rapid_filename = rapid_filename,
       updated_on = as.character(update_time)
diff --git a/inst/example_config.yml b/inst/example_config.yml
index 684c43b..05335b5 100644
--- a/inst/example_config.yml
+++ b/inst/example_config.yml
@@ -2,4 +2,5 @@ api_title: APIs.guru
 api_abbr: guru
 api_version: 2.2.0
 rapid_filename: example_beekeeper_rapid.rds
+security_data_filename: example_security_data.yml
 updated_on: 2026-05-12 07:57:02
diff --git a/inst/example_security_data.yml b/inst/example_security_data.yml
new file mode 100644
index 0000000..33e6c73
--- /dev/null
+++ b/inst/example_security_data.yml
@@ -0,0 +1,29 @@
+has_security: yes
+security_schemes:
+- name: api_key
+  description: Example API authentication key used to authorize requests.
+  parameter_name: key
+  arg_name: key
+  location: query
+  type: api_key
+  api_key: yes
+- name: api_token
+  description: Example API token used to authorize requests.
+  parameter_name: token
+  arg_name: token
+  location: query
+  type: api_key
+  api_key: yes
+security_arg_names:
+- key
+- token
+security_arg_list: key = key, token = token
+security_arg_helps:
+- name: key
+  description: Example API authentication key used to authorize requests.
+- name: token
+  description: Example API token used to authorize requests.
+security_arg_nulls: key = NULL, token = NULL
+security_signature: |-
+  key = Sys.getenv("TRELLO_KEY"),
+  token = Sys.getenv("TRELLO_TOKEN")
diff --git a/man/as_bk_data.Rd b/man/as_bk_data.Rd
index 36a56bd..9805726 100644
--- a/man/as_bk_data.Rd
+++ b/man/as_bk_data.Rd
@@ -1,13 +1,13 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/as_bk_data.R, R/generate_pkg-paths.R,
-%   R/generate_pkg-security.R
+% Please edit documentation in R/as_bk_data.R, R/generate_pkg_auth.R,
+%   R/generate_pkg_paths.R
 \name{as_bk_data}
 \alias{as_bk_data}
 \alias{as_bk_data,any-method}
-\alias{as_bk_data,rapid::paths-method}
 \alias{as_bk_data,rapid::security_schemes-method}
 \alias{as_bk_data,rapid::security_scheme_details-method}
 \alias{as_bk_data,rapid::api_key_security_scheme-method}
+\alias{as_bk_data,rapid::paths-method}
 \title{Prepare rapid objects for beekeeper}
 \usage{
 as_bk_data(x, ...)
@@ -15,9 +15,6 @@ as_bk_data(x, ...)
 ## S7 method for class <any>
 as_bk_data(x, ...)
 
-## S7 method for class <rapid::paths>
-as_bk_data(x, ...)
-
 ## S7 method for class <rapid::security_schemes>
 as_bk_data(x, ...)
 
@@ -26,6 +23,9 @@ as_bk_data(x, ...)
 
 ## S7 method for class <rapid::api_key_security_scheme>
 as_bk_data(x, ...)
+
+## S7 method for class <rapid::paths>
+as_bk_data(x, ...)
 }
 \arguments{
 \item{x}{(\code{any}) The object to check or coerce.}
diff --git a/man/dot-compile_param_class_descriptions.Rd b/man/dot-compile_param_class_descriptions.Rd
index cc3a760..d92f8f5 100644
--- a/man/dot-compile_param_class_descriptions.Rd
+++ b/man/dot-compile_param_class_descriptions.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.compile_param_class_descriptions}
 \alias{.compile_param_class_descriptions}
 \title{Compile parameter class descriptions}
diff --git a/man/dot-describe_param_classes.Rd b/man/dot-describe_param_classes.Rd
index e94c684..120768b 100644
--- a/man/dot-describe_param_classes.Rd
+++ b/man/dot-describe_param_classes.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.describe_param_classes}
 \alias{.describe_param_classes}
 \title{Describe parameter classes}
diff --git a/man/dot-extract_params_by_location.Rd b/man/dot-extract_params_by_location.Rd
index ae912a3..0668da0 100644
--- a/man/dot-extract_params_by_location.Rd
+++ b/man/dot-extract_params_by_location.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.extract_params_by_location}
 \alias{.extract_params_by_location}
 \title{Extract parameter names by location}
diff --git a/man/dot-flatten_params_df.Rd b/man/dot-flatten_params_df.Rd
index ba3583a..d4763eb 100644
--- a/man/dot-flatten_params_df.Rd
+++ b/man/dot-flatten_params_df.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.flatten_params_df}
 \alias{.flatten_params_df}
 \title{Flatten parameter metadata}
diff --git a/man/dot-generate_paths.Rd b/man/dot-generate_paths.Rd
index b434110..822e257 100644
--- a/man/dot-generate_paths.Rd
+++ b/man/dot-generate_paths.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.generate_paths}
 \alias{.generate_paths}
 \title{Generate files for API paths}
diff --git a/man/dot-generate_paths_file.Rd b/man/dot-generate_paths_file.Rd
index d137dad..56e4025 100644
--- a/man/dot-generate_paths_file.Rd
+++ b/man/dot-generate_paths_file.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.generate_paths_file}
 \alias{.generate_paths_file}
 \title{Generate one operation file}
diff --git a/man/dot-generate_paths_files.Rd b/man/dot-generate_paths_files.Rd
index 29e73d1..ef89c22 100644
--- a/man/dot-generate_paths_files.Rd
+++ b/man/dot-generate_paths_files.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.generate_paths_files}
 \alias{.generate_paths_files}
 \title{Generate files for all operations}
diff --git a/man/dot-generate_paths_test_file.Rd b/man/dot-generate_paths_test_file.Rd
index 0efc832..dbcc287 100644
--- a/man/dot-generate_paths_test_file.Rd
+++ b/man/dot-generate_paths_test_file.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.generate_paths_test_file}
 \alias{.generate_paths_test_file}
 \title{Generate one tag-level test file}
diff --git a/man/dot-generate_pkg_impl.Rd b/man/dot-generate_pkg_impl.Rd
deleted file mode 100644
index 90bae1b..0000000
--- a/man/dot-generate_pkg_impl.Rd
+++ /dev/null
@@ -1,23 +0,0 @@
-% Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg.R
-\name{.generate_pkg_impl}
-\alias{.generate_pkg_impl}
-\title{Generate package files from prepared inputs}
-\usage{
-.generate_pkg_impl(config, api_definition, security_data)
-}
-\arguments{
-\item{config}{(\code{list}) Package-generation configuration data.}
-
-\item{api_definition}{(\code{rapid::class_rapid}) The API definition to generate
-package code from.}
-
-\item{security_data}{(\code{list}) Generated security metadata.}
-}
-\value{
-(\code{character}, invisibly) Generated file paths.
-}
-\description{
-Generate package files from prepared inputs
-}
-\keyword{internal}
diff --git a/man/dot-generate_prepare.Rd b/man/dot-generate_prepare.Rd
index 6270c9f..54a7d87 100644
--- a/man/dot-generate_prepare.Rd
+++ b/man/dot-generate_prepare.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-prepare.R
+% Please edit documentation in R/generate_pkg_req_prepare.R
 \name{.generate_prepare}
 \alias{.generate_prepare}
 \title{Generate prepare files}
diff --git a/man/dot-generate_prepare_r.Rd b/man/dot-generate_prepare_r.Rd
index 7ab4510..5378607 100644
--- a/man/dot-generate_prepare_r.Rd
+++ b/man/dot-generate_prepare_r.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-prepare.R
+% Please edit documentation in R/generate_pkg_req_prepare.R
 \name{.generate_prepare_r}
 \alias{.generate_prepare_r}
 \title{Generate the prepare helper}
diff --git a/man/dot-generate_prepare_test.Rd b/man/dot-generate_prepare_test.Rd
index 55ba72f..25a6a9a 100644
--- a/man/dot-generate_prepare_test.Rd
+++ b/man/dot-generate_prepare_test.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-prepare.R
+% Please edit documentation in R/generate_pkg_req_prepare.R
 \name{.generate_prepare_test}
 \alias{.generate_prepare_test}
 \title{Generate prepare tests}
diff --git a/man/dot-generate_security.Rd b/man/dot-generate_security.Rd
index 13480f5..81ad35d 100644
--- a/man/dot-generate_security.Rd
+++ b/man/dot-generate_security.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.generate_security}
 \alias{.generate_security}
 \title{Generate security files and metadata}
diff --git a/man/dot-generate_security_arg_help.Rd b/man/dot-generate_security_arg_help.Rd
index a9e3026..235532e 100644
--- a/man/dot-generate_security_arg_help.Rd
+++ b/man/dot-generate_security_arg_help.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.generate_security_arg_help}
 \alias{.generate_security_arg_help}
 \title{Build security argument help entries}
diff --git a/man/dot-generate_security_signature.Rd b/man/dot-generate_security_signature.Rd
index ec9fa1e..754a2ce 100644
--- a/man/dot-generate_security_signature.Rd
+++ b/man/dot-generate_security_signature.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.generate_security_signature}
 \alias{.generate_security_signature}
 \title{Generate a security argument signature}
diff --git a/man/dot-generate_shared_params.Rd b/man/dot-generate_shared_params.Rd
index 27e35c7..cdbe5a5 100644
--- a/man/dot-generate_shared_params.Rd
+++ b/man/dot-generate_shared_params.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-shared.R
+% Please edit documentation in R/generate_pkg_shared.R
 \name{.generate_shared_params}
 \alias{.generate_shared_params}
 \title{Generate shared parameter docs}
diff --git a/man/dot-param_schema_to_r.Rd b/man/dot-param_schema_to_r.Rd
index c76b4ec..acef396 100644
--- a/man/dot-param_schema_to_r.Rd
+++ b/man/dot-param_schema_to_r.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.param_schema_to_r}
 \alias{.param_schema_to_r}
 \title{Map parameter schemas to \code{stbl} helpers}
diff --git a/man/dot-params_to_args.Rd b/man/dot-params_to_args.Rd
index b27777c..b27e7df 100644
--- a/man/dot-params_to_args.Rd
+++ b/man/dot-params_to_args.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.params_to_args}
 \alias{.params_to_args}
 \title{Convert parameters to a signature string}
diff --git a/man/dot-params_to_list.Rd b/man/dot-params_to_list.Rd
index 26d8e6e..0d74a51 100644
--- a/man/dot-params_to_list.Rd
+++ b/man/dot-params_to_list.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.params_to_list}
 \alias{.params_to_list}
 \title{Convert parameter rows to a list}
diff --git a/man/dot-params_to_named_args.Rd b/man/dot-params_to_named_args.Rd
index bf0003b..3b05411 100644
--- a/man/dot-params_to_named_args.Rd
+++ b/man/dot-params_to_named_args.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.params_to_named_args}
 \alias{.params_to_named_args}
 \title{Convert parameters to named arguments}
diff --git a/man/dot-params_to_validations.Rd b/man/dot-params_to_validations.Rd
index 11a951e..61ebaf1 100644
--- a/man/dot-params_to_validations.Rd
+++ b/man/dot-params_to_validations.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.params_to_validations}
 \alias{.params_to_validations}
 \title{Convert parameters to validation metadata}
diff --git a/man/dot-path_as_arg.Rd b/man/dot-path_as_arg.Rd
index cd46314..6f0118f 100644
--- a/man/dot-path_as_arg.Rd
+++ b/man/dot-path_as_arg.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.path_as_arg}
 \alias{.path_as_arg}
 \title{Convert a path to a request argument}
diff --git a/man/dot-path_row_to_list.Rd b/man/dot-path_row_to_list.Rd
index 67cb21b..0635116 100644
--- a/man/dot-path_row_to_list.Rd
+++ b/man/dot-path_row_to_list.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.path_row_to_list}
 \alias{.path_row_to_list}
 \title{Convert one operation row to template data}
diff --git a/man/dot-paths_fill_descriptions.Rd b/man/dot-paths_fill_descriptions.Rd
index b064906..ca9e8a1 100644
--- a/man/dot-paths_fill_descriptions.Rd
+++ b/man/dot-paths_fill_descriptions.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.paths_fill_descriptions}
 \alias{.paths_fill_descriptions}
 \title{Fill missing operation descriptions}
diff --git a/man/dot-paths_fill_operation_id.Rd b/man/dot-paths_fill_operation_id.Rd
index 8865fc6..109a052 100644
--- a/man/dot-paths_fill_operation_id.Rd
+++ b/man/dot-paths_fill_operation_id.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.paths_fill_operation_id}
 \alias{.paths_fill_operation_id}
 \title{Fill missing operation identifiers}
diff --git a/man/dot-paths_fill_summary.Rd b/man/dot-paths_fill_summary.Rd
index aaf38f3..64550b9 100644
--- a/man/dot-paths_fill_summary.Rd
+++ b/man/dot-paths_fill_summary.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.paths_fill_summary}
 \alias{.paths_fill_summary}
 \title{Fill missing operation summaries}
diff --git a/man/dot-paths_fill_tags.Rd b/man/dot-paths_fill_tags.Rd
index cb6a26f..117a4d7 100644
--- a/man/dot-paths_fill_tags.Rd
+++ b/man/dot-paths_fill_tags.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.paths_fill_tags}
 \alias{.paths_fill_tags}
 \title{Fill missing operation tags}
diff --git a/man/dot-paths_need_stbl.Rd b/man/dot-paths_need_stbl.Rd
index 5d02c81..46e786c 100644
--- a/man/dot-paths_need_stbl.Rd
+++ b/man/dot-paths_need_stbl.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.paths_need_stbl}
 \alias{.paths_need_stbl}
 \title{Determine whether generated paths need \code{stbl}}
diff --git a/man/dot-paths_to_clean_df.Rd b/man/dot-paths_to_clean_df.Rd
index f03df01..147750e 100644
--- a/man/dot-paths_to_clean_df.Rd
+++ b/man/dot-paths_to_clean_df.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.paths_to_clean_df}
 \alias{.paths_to_clean_df}
 \title{Convert API paths to an operations data frame}
diff --git a/man/dot-prep_param_args.Rd b/man/dot-prep_param_args.Rd
index 37a5660..6ab4fd5 100644
--- a/man/dot-prep_param_args.Rd
+++ b/man/dot-prep_param_args.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.prep_param_args}
 \alias{.prep_param_args}
 \title{Prepare parameter arguments}
diff --git a/man/dot-prepare_params_df.Rd b/man/dot-prepare_params_df.Rd
index 2d6923b..2faedda 100644
--- a/man/dot-prepare_params_df.Rd
+++ b/man/dot-prepare_params_df.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.prepare_params_df}
 \alias{.prepare_params_df}
 \title{Prepare parameter metadata}
diff --git a/man/dot-remove_security_args.Rd b/man/dot-remove_security_args.Rd
index 232147f..b2ec54c 100644
--- a/man/dot-remove_security_args.Rd
+++ b/man/dot-remove_security_args.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-paths.R
+% Please edit documentation in R/generate_pkg_paths.R
 \name{.remove_security_args}
 \alias{.remove_security_args}
 \title{Remove security parameters}
diff --git a/man/dot-security_arg_description_clean.Rd b/man/dot-security_arg_description_clean.Rd
index 4eb9200..89c5e9f 100644
--- a/man/dot-security_arg_description_clean.Rd
+++ b/man/dot-security_arg_description_clean.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.security_arg_description_clean}
 \alias{.security_arg_description_clean}
 \title{Format one security argument help entry}
diff --git a/man/dot-security_args_compile.Rd b/man/dot-security_args_compile.Rd
index db82de3..c37105a 100644
--- a/man/dot-security_args_compile.Rd
+++ b/man/dot-security_args_compile.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.security_args_compile}
 \alias{.security_args_compile}
 \title{Compile security argument metadata}
diff --git a/man/dot-security_scheme_collection_finalize.Rd b/man/dot-security_scheme_collection_finalize.Rd
index 11d3cad..8345413 100644
--- a/man/dot-security_scheme_collection_finalize.Rd
+++ b/man/dot-security_scheme_collection_finalize.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.security_scheme_collection_finalize}
 \alias{.security_scheme_collection_finalize}
 \title{Finalize collected security scheme data}
diff --git a/man/dot-security_scheme_description_fill.Rd b/man/dot-security_scheme_description_fill.Rd
index f93e9c7..1d98bff 100644
--- a/man/dot-security_scheme_description_fill.Rd
+++ b/man/dot-security_scheme_description_fill.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.security_scheme_description_fill}
 \alias{.security_scheme_description_fill}
 \title{Fill a missing security scheme description}
diff --git a/man/dot-security_scheme_rotate.Rd b/man/dot-security_scheme_rotate.Rd
index 5a825dc..175c847 100644
--- a/man/dot-security_scheme_rotate.Rd
+++ b/man/dot-security_scheme_rotate.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.security_scheme_rotate}
 \alias{.security_scheme_rotate}
 \title{Convert one security scheme to a list}
diff --git a/man/dot-security_schemes_collect.Rd b/man/dot-security_schemes_collect.Rd
index 7118e38..6ffc404 100644
--- a/man/dot-security_schemes_collect.Rd
+++ b/man/dot-security_schemes_collect.Rd
@@ -1,5 +1,5 @@
 % Generated by roxygen2: do not edit by hand
-% Please edit documentation in R/generate_pkg-security.R
+% Please edit documentation in R/generate_pkg_auth.R
 \name{.security_schemes_collect}
 \alias{.security_schemes_collect}
 \title{Collect security scheme metadata}
diff --git a/man/dot-shared-params.Rd b/man/dot-shared-params.Rd
index 19d92d9..91b0565 100644
--- a/man/dot-shared-params.Rd
+++ b/man/dot-shared-params.Rd
@@ -90,6 +90,9 @@ definition (rapid) file (relative to the package root).}
 
 \item{required}{(\code{logical}) Whether each parameter is required.}
 
+\item{save_security_data}{(\code{logical(1)}) Whether to save generated security
+metadata to a file and record that file in the beekeeper config.}
+
 \item{security_arg_description}{(\code{character(1)}) The argument description.}
 
 \item{security_arg_name}{(\code{character(1)}) The argument name.}
@@ -119,6 +122,9 @@ security scheme details.}
 \item{security_schemes}{(\code{rapid::class_security_schemes}) Security schemes
 from the API definition.}
 
+\item{security_data_filename}{(\code{character(1)} or \code{fs_path}) The path to the
+saved security metadata file (relative to the package root).}
+
 \item{tag_operations}{(\code{list}) Operations grouped under one tag.}
 
 \item{tag_name}{(\code{character(1)}) The tag name.}
diff --git a/man/dot-use_httptest2.Rd b/man/dot-use_httptest2.Rd
new file mode 100644
index 0000000..d81a0dc
--- /dev/null
+++ b/man/dot-use_httptest2.Rd
@@ -0,0 +1,19 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg-setup.R
+\name{.use_httptest2}
+\alias{.use_httptest2}
+\title{Ensure httptest2 is configured}
+\usage{
+.use_httptest2(pkg_dir)
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{NULL}, invisibly) Called for setup side effects.
+}
+\description{
+Ensure httptest2 is configured
+}
+\keyword{internal}
diff --git a/man/dot-use_nectar.Rd b/man/dot-use_nectar.Rd
new file mode 100644
index 0000000..757d3b2
--- /dev/null
+++ b/man/dot-use_nectar.Rd
@@ -0,0 +1,19 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg-setup.R
+\name{.use_nectar}
+\alias{.use_nectar}
+\title{Add nectar to imports}
+\usage{
+.use_nectar(pkg_dir = ".")
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{character(1)}, invisibly) The package name.
+}
+\description{
+Add nectar to imports
+}
+\keyword{internal}
diff --git a/man/dot-use_pkg_beekeeper.Rd b/man/dot-use_pkg_beekeeper.Rd
new file mode 100644
index 0000000..f6e52e2
--- /dev/null
+++ b/man/dot-use_pkg_beekeeper.Rd
@@ -0,0 +1,19 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg-setup.R
+\name{.use_pkg_beekeeper}
+\alias{.use_pkg_beekeeper}
+\title{Add beekeeper to suggests}
+\usage{
+.use_pkg_beekeeper(pkg_dir = ".")
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{character(1)}, invisibly) The package name.
+}
+\description{
+Add beekeeper to suggests
+}
+\keyword{internal}
diff --git a/man/dot-use_r_directory.Rd b/man/dot-use_r_directory.Rd
new file mode 100644
index 0000000..fe49c82
--- /dev/null
+++ b/man/dot-use_r_directory.Rd
@@ -0,0 +1,19 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg-setup.R
+\name{.use_r_directory}
+\alias{.use_r_directory}
+\title{Ensure the R directory exists}
+\usage{
+.use_r_directory(pkg_dir)
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{NULL}, invisibly) Called for setup side effects.
+}
+\description{
+Ensure the R directory exists
+}
+\keyword{internal}
diff --git a/man/dot-use_testthat.Rd b/man/dot-use_testthat.Rd
new file mode 100644
index 0000000..c3fddeb
--- /dev/null
+++ b/man/dot-use_testthat.Rd
@@ -0,0 +1,19 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg-setup.R
+\name{.use_testthat}
+\alias{.use_testthat}
+\title{Ensure testthat is configured}
+\usage{
+.use_testthat(pkg_dir)
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{NULL}, invisibly) Called for setup side effects.
+}
+\description{
+Ensure testthat is configured
+}
+\keyword{internal}
diff --git a/man/dot-without_security_file_path.Rd b/man/dot-without_security_file_path.Rd
new file mode 100644
index 0000000..1f91b60
--- /dev/null
+++ b/man/dot-without_security_file_path.Rd
@@ -0,0 +1,18 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg_auth.R
+\name{.without_security_file_path}
+\alias{.without_security_file_path}
+\title{Remove generated file paths from saved security metadata}
+\usage{
+.without_security_file_path(security_data)
+}
+\arguments{
+\item{security_data}{(\code{list}) Generated security metadata.}
+}
+\value{
+(\code{list}) Security metadata suitable for serialization.
+}
+\description{
+Remove generated file paths from saved security metadata
+}
+\keyword{internal}
diff --git a/man/dot-write_config_field.Rd b/man/dot-write_config_field.Rd
new file mode 100644
index 0000000..f50d03a
--- /dev/null
+++ b/man/dot-write_config_field.Rd
@@ -0,0 +1,26 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg_auth.R
+\name{.write_config_field}
+\alias{.write_config_field}
+\title{Update one config field}
+\usage{
+.write_config_field(field, value, config_filename, pkg_dir)
+}
+\arguments{
+\item{field}{(\code{character(1)}) The config field to write.}
+
+\item{value}{(\code{character(1)}) The value to write.}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{character(1)}) The written config filename.
+}
+\description{
+Update one config field
+}
+\keyword{internal}
diff --git a/man/dot-write_security_data.Rd b/man/dot-write_security_data.Rd
new file mode 100644
index 0000000..f7a03c7
--- /dev/null
+++ b/man/dot-write_security_data.Rd
@@ -0,0 +1,32 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg_auth.R
+\name{.write_security_data}
+\alias{.write_security_data}
+\title{Write saved security metadata and update the config}
+\usage{
+.write_security_data(
+  security_data,
+  security_data_filename,
+  config_filename,
+  pkg_dir
+)
+}
+\arguments{
+\item{security_data}{(\code{list}) Generated security metadata.}
+
+\item{security_data_filename}{(\code{character(1)} or \code{fs_path}) The path to the
+saved security metadata file (relative to the package root).}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{character(1)}) The saved security metadata filename.
+}
+\description{
+Write saved security metadata and update the config
+}
+\keyword{internal}
diff --git a/man/generate_pkg_auth.Rd b/man/generate_pkg_auth.Rd
new file mode 100644
index 0000000..e1e559f
--- /dev/null
+++ b/man/generate_pkg_auth.Rd
@@ -0,0 +1,49 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg_auth.R
+\name{generate_pkg_auth}
+\alias{generate_pkg_auth}
+\title{Generate authentication helpers}
+\usage{
+generate_pkg_auth(
+  api_abbr = read_api_abbr(pkg_dir, config_filename),
+  security_schemes = read_security_schemes(pkg_dir, read_rapid_filename(pkg_dir,
+    config_filename)),
+  save_security_data = TRUE,
+  security_data_filename = "_beekeeper_security.yml",
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+)
+}
+\arguments{
+\item{api_abbr}{(\code{character(1)}) A short (about 2-5 letter) abbreviation for
+the API, for use in function names and environment variables.}
+
+\item{security_schemes}{(\code{rapid::class_security_schemes}) Security schemes
+from the API definition.}
+
+\item{save_security_data}{(\code{logical(1)}) Whether to save generated security
+metadata to a file and record that file in the beekeeper config.}
+
+\item{security_data_filename}{(\code{character(1)} or \code{fs_path}) The path to the
+saved security metadata file (relative to the package root).}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{list}) Generated security metadata.
+}
+\description{
+Generate the authentication helper file for a package under development from
+the API security schemes stored in the OpenAPI definition. This supports
+incremental package scaffolding when you want to review or customize auth
+handling before generating the rest of the package files.
+}
+\details{
+When \code{save_security_data} is \code{TRUE}, the generated security metadata is saved
+to \code{security_data_filename} and that filename is recorded in the beekeeper
+config so later generation steps can reuse it.
+}
diff --git a/man/generate_pkg_paths.Rd b/man/generate_pkg_paths.Rd
new file mode 100644
index 0000000..ca49c8e
--- /dev/null
+++ b/man/generate_pkg_paths.Rd
@@ -0,0 +1,43 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg_paths.R
+\name{generate_pkg_paths}
+\alias{generate_pkg_paths}
+\title{Generate files for API paths}
+\usage{
+generate_pkg_paths(
+  api_abbr = read_api_abbr(pkg_dir, config_filename),
+  api_definition = read_api_definition(pkg_dir, read_rapid_filename(pkg_dir,
+    config_filename)),
+  security_data = read_security_data(pkg_dir, config_filename),
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+)
+}
+\arguments{
+\item{api_abbr}{(\code{character(1)}) A short (about 2-5 letter) abbreviation for
+the API, for use in function names and environment variables.}
+
+\item{api_definition}{(\code{rapid::class_rapid}) The API definition to generate
+package code from.}
+
+\item{security_data}{(\code{list}) Generated security metadata.}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{character}) Generated file paths.
+}
+\description{
+Generate operation functions and their tests from the API paths stored in the
+OpenAPI definition. This is useful when you want to scaffold endpoint
+wrappers separately from the auth, request-preparation, or shared-parameter
+steps.
+}
+\details{
+The generated files include one or more \verb{paths-*.R} files plus any required
+test helpers under \verb{tests/testthat/}.
+}
diff --git a/man/generate_pkg_req_prepare.Rd b/man/generate_pkg_req_prepare.Rd
new file mode 100644
index 0000000..fb6f443
--- /dev/null
+++ b/man/generate_pkg_req_prepare.Rd
@@ -0,0 +1,47 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg_req_prepare.R
+\name{generate_pkg_req_prepare}
+\alias{generate_pkg_req_prepare}
+\title{Generate request-prepare helpers}
+\usage{
+generate_pkg_req_prepare(
+  api_abbr = read_api_abbr(pkg_dir, config_filename),
+  api_definition = read_api_definition(pkg_dir, read_rapid_filename(pkg_dir,
+    config_filename)),
+  api_title = read_api_title(pkg_dir, config_filename),
+  security_data = read_security_data(pkg_dir, config_filename),
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+)
+}
+\arguments{
+\item{api_abbr}{(\code{character(1)}) A short (about 2-5 letter) abbreviation for
+the API, for use in function names and environment variables.}
+
+\item{api_definition}{(\code{rapid::class_rapid}) The API definition to generate
+package code from.}
+
+\item{api_title}{(\code{character(1)}) The API title used in generated package
+files.}
+
+\item{security_data}{(\code{list}) Generated security metadata.}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{character}) Generated file paths.
+}
+\description{
+Generate the \verb{*_req_prepare()} helper and its initial test file for a package
+under development. This scaffolds the central request-construction helper
+used by generated endpoint wrappers, allowing you to inspect or customize it
+before generating path functions.
+}
+\details{
+Saved security metadata from \code{\link[=generate_pkg_auth]{generate_pkg_auth()}} is used, when available,
+to include auth parameters in the generated request helper.
+}
diff --git a/man/generate_pkg_shared_params.Rd b/man/generate_pkg_shared_params.Rd
new file mode 100644
index 0000000..6451e72
--- /dev/null
+++ b/man/generate_pkg_shared_params.Rd
@@ -0,0 +1,33 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/generate_pkg_shared.R
+\name{generate_pkg_shared_params}
+\alias{generate_pkg_shared_params}
+\title{Generate shared parameter docs}
+\usage{
+generate_pkg_shared_params(
+  security_data = read_security_data(pkg_dir, config_filename),
+  config_filename = "_beekeeper.yml",
+  pkg_dir = "."
+)
+}
+\arguments{
+\item{security_data}{(\code{list}) Generated security metadata.}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+}
+\value{
+(\code{character(1)}) The generated file path.
+}
+\description{
+Generate the shared roxygen parameter definitions used across scaffolded
+functions. This lets you regenerate or customize the shared parameter topic
+independently while iterating on the rest of the generated package files.
+}
+\details{
+Saved security metadata from \code{\link[=generate_pkg_auth]{generate_pkg_auth()}} is used, when available,
+to include auth-related shared parameter documentation.
+}
diff --git a/man/read_api_abbr.Rd b/man/read_api_abbr.Rd
index 09774ca..ddc449c 100644
--- a/man/read_api_abbr.Rd
+++ b/man/read_api_abbr.Rd
@@ -31,6 +31,9 @@ Other config readers:
 \code{\link[=read_api_definition]{read_api_definition()}},
 \code{\link[=read_api_title]{read_api_title()}},
 \code{\link[=read_config]{read_config()}},
-\code{\link[=read_rapid_filename]{read_rapid_filename()}}
+\code{\link[=read_rapid_filename]{read_rapid_filename()}},
+\code{\link[=read_security_data]{read_security_data()}},
+\code{\link[=read_security_data_filename]{read_security_data_filename()}},
+\code{\link[=read_security_schemes]{read_security_schemes()}}
 }
 \concept{config readers}
diff --git a/man/read_api_definition.Rd b/man/read_api_definition.Rd
index 48dca93..d1ff4ab 100644
--- a/man/read_api_definition.Rd
+++ b/man/read_api_definition.Rd
@@ -20,7 +20,7 @@ definition (rapid) file (relative to the package root).}
 (\code{rapid::class_rapid}) The definition of the API.
 }
 \description{
-Reads an RDS file (default name \verb{_beekeeper_rapid.rds}) with the API
+Read an RDS file (default name \verb{_beekeeper_rapid.rds}) with the API
 definition stored as a \code{\link[rapid:class_rapid]{rapid::class_rapid()}} object. This file is generated
 by \code{\link[=use_beekeeper]{use_beekeeper()}} based on an OpenAPI definition file.
 }
@@ -37,6 +37,9 @@ Other config readers:
 \code{\link[=read_api_abbr]{read_api_abbr()}},
 \code{\link[=read_api_title]{read_api_title()}},
 \code{\link[=read_config]{read_config()}},
-\code{\link[=read_rapid_filename]{read_rapid_filename()}}
+\code{\link[=read_rapid_filename]{read_rapid_filename()}},
+\code{\link[=read_security_data]{read_security_data()}},
+\code{\link[=read_security_data_filename]{read_security_data_filename()}},
+\code{\link[=read_security_schemes]{read_security_schemes()}}
 }
 \concept{config readers}
diff --git a/man/read_api_title.Rd b/man/read_api_title.Rd
index 9f1d6c2..f089fdc 100644
--- a/man/read_api_title.Rd
+++ b/man/read_api_title.Rd
@@ -31,6 +31,9 @@ Other config readers:
 \code{\link[=read_api_abbr]{read_api_abbr()}},
 \code{\link[=read_api_definition]{read_api_definition()}},
 \code{\link[=read_config]{read_config()}},
-\code{\link[=read_rapid_filename]{read_rapid_filename()}}
+\code{\link[=read_rapid_filename]{read_rapid_filename()}},
+\code{\link[=read_security_data]{read_security_data()}},
+\code{\link[=read_security_data_filename]{read_security_data_filename()}},
+\code{\link[=read_security_schemes]{read_security_schemes()}}
 }
 \concept{config readers}
diff --git a/man/read_config.Rd b/man/read_config.Rd
index 664a7a9..2935876 100644
--- a/man/read_config.Rd
+++ b/man/read_config.Rd
@@ -15,10 +15,11 @@ yaml config file (relative to the package root).}
 }
 \value{
 (\code{list}) Configuration information, with elements \code{api_title},
-\code{api_abbr}, \code{api_version}, \code{rapid_filename}, and \code{updated_on}.
+\code{api_abbr}, \code{api_version}, \code{rapid_filename}, and \code{updated_on}, plus
+\code{security_data_filename} when present.
 }
 \description{
-Reads a YAML file (default name \verb{_beekeeper.yml}) with configuration
+Read a YAML file (default name \verb{_beekeeper.yml}) with configuration
 information about the API and the package. This file is generated by
 \code{\link[=use_beekeeper]{use_beekeeper()}}, or can be created manually.
 }
@@ -36,6 +37,8 @@ this is \verb{_beekeeper_rapid.rds}, and is generated by \code{\link[=use_beekee
 on an OpenAPI definition file.
 \item \code{updated_on} (\code{character(1)}): A timestamp of when the API definition was
 last updated, in the format "YYYY-MM-DD HH:MM:SS" (UTC).
+\item \code{security_data_filename} (\code{character(1)}): Optionally, the path (relative
+to the package root) where generated security metadata is stored.
 }
 }
 \seealso{
@@ -43,6 +46,9 @@ Other config readers:
 \code{\link[=read_api_abbr]{read_api_abbr()}},
 \code{\link[=read_api_definition]{read_api_definition()}},
 \code{\link[=read_api_title]{read_api_title()}},
-\code{\link[=read_rapid_filename]{read_rapid_filename()}}
+\code{\link[=read_rapid_filename]{read_rapid_filename()}},
+\code{\link[=read_security_data]{read_security_data()}},
+\code{\link[=read_security_data_filename]{read_security_data_filename()}},
+\code{\link[=read_security_schemes]{read_security_schemes()}}
 }
 \concept{config readers}
diff --git a/man/read_rapid_filename.Rd b/man/read_rapid_filename.Rd
index 94690ed..e1d3b52 100644
--- a/man/read_rapid_filename.Rd
+++ b/man/read_rapid_filename.Rd
@@ -31,6 +31,9 @@ Other config readers:
 \code{\link[=read_api_abbr]{read_api_abbr()}},
 \code{\link[=read_api_definition]{read_api_definition()}},
 \code{\link[=read_api_title]{read_api_title()}},
-\code{\link[=read_config]{read_config()}}
+\code{\link[=read_config]{read_config()}},
+\code{\link[=read_security_data]{read_security_data()}},
+\code{\link[=read_security_data_filename]{read_security_data_filename()}},
+\code{\link[=read_security_schemes]{read_security_schemes()}}
 }
 \concept{config readers}
diff --git a/man/read_security_data.Rd b/man/read_security_data.Rd
new file mode 100644
index 0000000..11fecb8
--- /dev/null
+++ b/man/read_security_data.Rd
@@ -0,0 +1,46 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/read_config.R
+\name{read_security_data}
+\alias{read_security_data}
+\title{Read saved security metadata}
+\usage{
+read_security_data(
+  pkg_dir = ".",
+  config_filename = "_beekeeper.yml",
+  security_data_filename = read_security_data_filename(pkg_dir, config_filename)
+)
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+
+\item{security_data_filename}{(\code{character(1)} or \code{fs_path}) The path to the
+saved security metadata file (relative to the package root).}
+}
+\value{
+(\code{list}) Saved security metadata.
+}
+\description{
+Read prepared security metadata from a YAML file (default name
+\verb{_beekeeper_security.yml}) generated via \code{\link[=generate_pkg_auth]{generate_pkg_auth()}}.
+}
+\examples{
+read_security_data(
+  pkg_dir = fs::path_package("beekeeper"),
+  config_filename = "example_config.yml"
+)
+}
+\seealso{
+Other config readers:
+\code{\link[=read_api_abbr]{read_api_abbr()}},
+\code{\link[=read_api_definition]{read_api_definition()}},
+\code{\link[=read_api_title]{read_api_title()}},
+\code{\link[=read_config]{read_config()}},
+\code{\link[=read_rapid_filename]{read_rapid_filename()}},
+\code{\link[=read_security_data_filename]{read_security_data_filename()}},
+\code{\link[=read_security_schemes]{read_security_schemes()}}
+}
+\concept{config readers}
diff --git a/man/read_security_data_filename.Rd b/man/read_security_data_filename.Rd
new file mode 100644
index 0000000..a01a412
--- /dev/null
+++ b/man/read_security_data_filename.Rd
@@ -0,0 +1,38 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/read_config.R
+\name{read_security_data_filename}
+\alias{read_security_data_filename}
+\title{Read saved security metadata filename}
+\usage{
+read_security_data_filename(pkg_dir = ".", config_filename = "_beekeeper.yml")
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+
+\item{config_filename}{(\code{character(1)} or \code{fs_path}) The path to a beekeeper
+yaml config file (relative to the package root).}
+}
+\value{
+(\code{character(1)}) The configured security metadata file path.
+}
+\description{
+Read the \code{security_data_filename} field from a beekeeper config file.
+}
+\examples{
+read_security_data_filename(
+  pkg_dir = fs::path_package("beekeeper"),
+  config_filename = "example_config.yml"
+)
+}
+\seealso{
+Other config readers:
+\code{\link[=read_api_abbr]{read_api_abbr()}},
+\code{\link[=read_api_definition]{read_api_definition()}},
+\code{\link[=read_api_title]{read_api_title()}},
+\code{\link[=read_config]{read_config()}},
+\code{\link[=read_rapid_filename]{read_rapid_filename()}},
+\code{\link[=read_security_data]{read_security_data()}},
+\code{\link[=read_security_schemes]{read_security_schemes()}}
+}
+\concept{config readers}
diff --git a/man/read_security_schemes.Rd b/man/read_security_schemes.Rd
new file mode 100644
index 0000000..0355307
--- /dev/null
+++ b/man/read_security_schemes.Rd
@@ -0,0 +1,37 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/read_config.R
+\name{read_security_schemes}
+\alias{read_security_schemes}
+\title{Read security schemes from an API definition}
+\usage{
+read_security_schemes(
+  pkg_dir = ".",
+  rapid_filename = read_rapid_filename(pkg_dir)
+)
+}
+\arguments{
+\item{pkg_dir}{(\code{character(1)} or \code{fs_path}) The directory containing package
+files.}
+
+\item{rapid_filename}{(\code{character(1)} or \code{fs_path}) The path to the R API
+definition (rapid) file (relative to the package root).}
+}
+\value{
+(\code{rapid::class_security_schemes}) Security schemes from the API
+definition.
+}
+\description{
+Read the security schemes from an API definition stored as a
+\code{\link[rapid:class_rapid]{rapid::class_rapid()}} object.
+}
+\seealso{
+Other config readers:
+\code{\link[=read_api_abbr]{read_api_abbr()}},
+\code{\link[=read_api_definition]{read_api_definition()}},
+\code{\link[=read_api_title]{read_api_title()}},
+\code{\link[=read_config]{read_config()}},
+\code{\link[=read_rapid_filename]{read_rapid_filename()}},
+\code{\link[=read_security_data]{read_security_data()}},
+\code{\link[=read_security_data_filename]{read_security_data_filename()}}
+}
+\concept{config readers}
diff --git a/tests/testthat/test-generate_pkg-security.R b/tests/testthat/test-generate_pkg_auth.R
similarity index 61%
rename from tests/testthat/test-generate_pkg-security.R
rename to tests/testthat/test-generate_pkg_auth.R
index 1f26d75..f108347 100644
--- a/tests/testthat/test-generate_pkg-security.R
+++ b/tests/testthat/test-generate_pkg_auth.R
@@ -45,3 +45,33 @@ test_that(".generate_security() generates security file for trello", {
     security_expected
   )
 })
+
+test_that("generate_pkg_auth() writes auth files and saved security data (#101)", {
+  skip_on_cran()
+  config_text <- readLines(test_path("_fixtures", "trello", "_beekeeper.yml"))
+  security_expected <- readLines(test_path("_fixtures", "trello", "020-auth.R"))
+
+  create_local_package()
+  writeLines(config_text, "_beekeeper.yml")
+  saveRDS(trello_api_definition, "_beekeeper_rapid.rds")
+
+  result <- generate_pkg_auth()
+
+  expect_identical(
+    basename(result$security_file_path),
+    "020-auth.R"
+  )
+  expect_identical(scrub_testpkg(readLines("R/020-auth.R")), security_expected)
+  expect_true(fs::file_exists("_beekeeper_security.yml"))
+  expect_identical(
+    read_config()$security_data_filename,
+    "_beekeeper_security.yml"
+  )
+
+  saved_security_data <- read_security_data()
+  expect_identical(
+    saved_security_data$security_arg_names,
+    result$security_arg_names
+  )
+  expect_false("security_file_path" %in% names(saved_security_data))
+})
diff --git a/tests/testthat/test-generate_pkg-paths.R b/tests/testthat/test-generate_pkg_paths.R
similarity index 93%
rename from tests/testthat/test-generate_pkg-paths.R
rename to tests/testthat/test-generate_pkg_paths.R
index a219faa..995d034 100644
--- a/tests/testthat/test-generate_pkg-paths.R
+++ b/tests/testthat/test-generate_pkg_paths.R
@@ -258,6 +258,29 @@ test_that(".paths_need_stbl() returns FALSE for empty paths (#69)", {
   expect_false(.paths_need_stbl(rapid::class_paths(), character()))
 })
 
+test_that("generate_pkg_paths() reads saved inputs from config (#101)", {
+  skip_on_cran()
+  config_text <- readLines(test_path("_fixtures", "guru", "_beekeeper.yml"))
+  path_expected <- readLines(test_path(
+    "_fixtures",
+    "guru",
+    "paths-apis-list_apis.R"
+  ))
+
+  create_local_package()
+  writeLines(config_text, "_beekeeper.yml")
+  saveRDS(guru_api_definition, "_beekeeper_rapid.rds")
+  generate_pkg_auth()
+
+  test_result <- generate_pkg_paths()
+
+  expect_contains(basename(test_result), "setup.R")
+  expect_identical(
+    scrub_testpkg(readLines("R/paths-apis-list_apis.R")),
+    path_expected
+  )
+})
+
 test_that(".generate_paths_file() renders header and cookie params correctly (#84, #69)", {
   skip_on_cran()
   expected_content <- readLines(
diff --git a/tests/testthat/test-generate_pkg-prepare.R b/tests/testthat/test-generate_pkg_req_prepare.R
similarity index 55%
rename from tests/testthat/test-generate_pkg-prepare.R
rename to tests/testthat/test-generate_pkg_req_prepare.R
index 5563c67..d6a6342 100644
--- a/tests/testthat/test-generate_pkg-prepare.R
+++ b/tests/testthat/test-generate_pkg_req_prepare.R
@@ -29,3 +29,29 @@ test_that(".generate_prepare() generates prepare file.", {
   ))
   expect_identical(t_prepare_result, t_prepare_expected)
 })
+
+test_that("generate_pkg_req_prepare() reads saved inputs from config (#101)", {
+  skip_on_cran()
+  config_text <- readLines(test_path("_fixtures", "trello", "_beekeeper.yml"))
+  prepare_expected <- readLines(test_path(
+    "_fixtures",
+    "trello",
+    "010-prepare.R"
+  ))
+
+  create_local_package()
+  writeLines(config_text, "_beekeeper.yml")
+  saveRDS(trello_api_definition, "_beekeeper_rapid.rds")
+  generate_pkg_auth()
+
+  test_result <- generate_pkg_req_prepare()
+
+  expect_identical(
+    basename(test_result),
+    c("010-prepare.R", "test-010-prepare.R")
+  )
+  expect_identical(
+    scrub_testpkg(readLines("R/010-prepare.R")),
+    prepare_expected
+  )
+})
diff --git a/tests/testthat/test-generate_pkg-shared.R b/tests/testthat/test-generate_pkg_shared.R
similarity index 69%
rename from tests/testthat/test-generate_pkg-shared.R
rename to tests/testthat/test-generate_pkg_shared.R
index 85dfc12..08d2092 100644
--- a/tests/testthat/test-generate_pkg-shared.R
+++ b/tests/testthat/test-generate_pkg_shared.R
@@ -37,3 +37,19 @@ test_that(".generate_shared_params() writes security params for API with securit
     shared_expected
   )
 })
+
+test_that("generate_pkg_shared_params() reads saved security data (#101)", {
+  skip_on_cran()
+  config_text <- readLines(test_path("_fixtures", "trello", "_beekeeper.yml"))
+  shared_expected <- readLines(test_path("_fixtures", "trello", "000-shared.R"))
+
+  create_local_package()
+  writeLines(config_text, "_beekeeper.yml")
+  saveRDS(trello_api_definition, "_beekeeper_rapid.rds")
+  generate_pkg_auth()
+
+  result <- generate_pkg_shared_params()
+
+  expect_identical(basename(result), "000-shared.R")
+  expect_identical(readLines("R/000-shared.R"), shared_expected)
+})
diff --git a/tests/testthat/test-read_config.R b/tests/testthat/test-read_config.R
index 84b890b..f52090c 100644
--- a/tests/testthat/test-read_config.R
+++ b/tests/testthat/test-read_config.R
@@ -24,3 +24,72 @@ test_that("read_api_title() reads api titles (#99)", {
   withr::defer(memoise::forget(read_config))
   expect_equal(read_api_title(test_path("_fixtures", "guru")), "APIs.guru")
 })
+
+test_that("read_security_schemes() reads security schemes (#101)", {
+  withr::defer(memoise::forget(read_config))
+
+  result <- read_security_schemes(test_path("_fixtures", "trello"))
+
+  expect_s7_class(result, rapid::class_security_schemes)
+  expect_identical(
+    result@name,
+    trello_api_definition@components@security_schemes@name
+  )
+})
+
+test_that("read_security_data_filename() defaults when config omits it (#101)", {
+  withr::defer(memoise::forget(read_config))
+
+  expect_identical(
+    read_security_data_filename(test_path("_fixtures", "guru")),
+    "_beekeeper_security.yml"
+  )
+})
+
+test_that("read_security_data_filename() reads configured filenames (#101)", {
+  withr::defer(memoise::forget(read_config))
+  config_text <- c(
+    readLines(test_path("_fixtures", "guru", "_beekeeper.yml")),
+    "security_data_filename: custom_security.yml"
+  )
+
+  create_local_package()
+  writeLines(config_text, "_beekeeper.yml")
+
+  expect_identical(read_security_data_filename(), "custom_security.yml")
+})
+
+test_that("read_security_data() reads saved security data (#101)", {
+  withr::defer(memoise::forget(read_config))
+  config_text <- c(
+    readLines(test_path("_fixtures", "trello", "_beekeeper.yml")),
+    "security_data_filename: example_security_data.yml"
+  )
+  security_data_text <- readLines(system.file(
+    "example_security_data.yml",
+    package = "beekeeper"
+  ))
+
+  create_local_package()
+  writeLines(config_text, "_beekeeper.yml")
+  writeLines(security_data_text, "example_security_data.yml")
+
+  result <- read_security_data()
+
+  expect_true(result$has_security)
+  expect_identical(result$security_arg_names, c("key", "token"))
+})
+
+test_that("read_security_data() returns empty list for empty files (#101)", {
+  withr::defer(memoise::forget(read_config))
+  config_text <- c(
+    readLines(test_path("_fixtures", "guru", "_beekeeper.yml")),
+    "security_data_filename: empty_security.yml"
+  )
+
+  create_local_package()
+  writeLines(config_text, "_beekeeper.yml")
+  file.create("empty_security.yml")
+
+  expect_identical(read_security_data(), list())
+})