Security Practices

Your webhook is the only place your credentials ever exist. Token Vault never receives, processes, or stores credential plaintext — there is nothing here to encrypt or decrypt. Whether and how your webhook encrypts at rest is entirely your choice; reference webhook implementations use AES-256-GCM with a unique nonce per credential, but the key never leaves your infrastructure.

All communication with Token Vault uses TLS 1.3. API endpoints enforce HTTPS. HSTS headers with preload are served on all responses to prevent protocol downgrade attacks.

Agent credential requests never proxy through Token Vault. Token Vault validates the agent's key, runs your ABAC policies, signs a short-lived ticket, and redirects — the agent follows the redirect straight to your webhook, which returns the credential directly. Token Vault's transcript ends at the redirect:

GET /api/agents/credentials?service=github HTTP/1.1
Authorization: Bearer tvagent_...

HTTP/1.1 307 Temporary Redirect
Location: https://your-webhook.example.com/v1/credential?ticket=...

# Token Vault's transcript ends here — no credential bytes.
# The agent follows the redirect directly to your webhook.

Agent API keys are scoped and time-limited. Each agent receives only the specific credentials it needs, with automatic expiry. Policies enable fine-grained rules including time windows, IP allowlists, rate limits, geo-restrictions, and manual approval flows.

Every credential access, agent grant, policy evaluation, and administrative action is recorded in an immutable audit log. Review who accessed what, when, and from where in the dashboard.

Token Vault runs on Google Cloud Platform. The backend API is deployed on Cloud Run with automatic scaling and isolation. Control-plane data (identities, grants, policies, and audit metadata) is stored in Firestore with Google-managed encryption at rest — credentials never touch Token Vault's database. Authentication is handled by Firebase Auth. All infrastructure is in the europe-west4 region.

Taking your webhook offline immediately cuts all access to your credentials — there is no cache, no fallback, nothing in Token Vault to fall back to. Bring it back online and everything resumes instantly. This is by design. You can go further and firewall Token Vault's static outbound IP directly:

# Block Token Vault's static egress IP at your webhook's firewall
iptables -A INPUT -s 34.12.35.243/32 -j DROP

# Cloudflare Worker equivalent — WAF custom rule
(ip.src eq 34.12.35.243) → Block