Encrypted provider credentials, decrypted at the boundary

Provider secrets live encrypted in the binding row and are decrypted once, in the registry, so adapters receive usable strings and secrets never sit in plaintext.

What it is

Any binding config value beginning with enc: is run through decryptOrPassthrough before the adapter sees it. The decrypted chain is cached for 60 seconds with an explicit invalidate hook used by the provider admin panel.

Also called: API keys at rest · encrypted auth token · provider config secrets

See it
Encrypted provider credentials, decrypted at the boundary
Area
Integrations
Group
Provider architecture
System
Provider Independence
Solves
2 named problems
01Secrets are written as enc:v1: ciphertext (AES-256-GCM via src/lib/crypto.ts).
02loadBindings reads the row; decryptConfig walks the config object and unwraps every enc: value.
03The adapter reads a plain string and authenticates.
Show a binding row with config JSON where the secret renders as enc:v1:•••• and an arrow into the adapter showing the unwrapped value never leaving the server. Sample data — no customer information appears here.
How it works
  1. 1Secrets are written as enc:v1: ciphertext (AES-256-GCM via src/lib/crypto.ts).
  2. 2loadBindings reads the row; decryptConfig walks the config object and unwraps every enc: value.
  3. 3The adapter reads a plain string and authenticates.
  4. 4invalidateProviderBindings(orgId) drops the cache after an operator change.
Why we built it

The function carries a full incident write-up (Keith 08-14): decryptOrPassthrough returns an object, and the old code 'assigned that OBJECT straight onto the config'. Every adapter reading `typeof config.authToken === "string" ? ... : ""` saw an object and fell back to empty, which Twilio's adapter treats as unconfigured and returns 'skipped' — silently. 'The effect: any tenant whose credentials were encrypted at rest had their PRIMARY provider quietly skipped and every message delivered by the fallback. Graber's texts kept going out through GoHighLevel minutes after their own Twilio A2P campaign was approved, and the only visible symptom was GHL's error text — which made it look like a GHL problem rather than ours.'

The problem
  • A silent decryption bug demoted every encrypted-credential tenant to their fallback provider.
  • Provider secrets would otherwise have to sit in plaintext for adapters to read.
Sound familiar?
What you get
Credentials are encrypted at rest and unwrapped in exactly one place.
A provider switch takes effect on the next send after cache invalidation.

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →