Credential Storage | Gazebo Docs

Credentials are stored in the Gazebo vault — a PostgreSQL table where every value is encrypted at rest with AES-256-GCM before being written.

Storage model

Each credential entry stores:

user_id — which account owns this credential
service — the service name (e.g. stripe)
ciphertext — the AES-256-GCM encrypted credential value
nonce — the random nonce used for this encryption (required for decryption)
created_at, updated_at

The plaintext credential value is never written to the database.

Zero-plaintext guarantee

After a credential is stored, its plaintext value is never returned to any web client. This applies to:

The Settings page in the dashboard (shows connection status, not the credential)
The API (no endpoint returns plaintext credentials to authenticated web sessions)
Error messages and logs (credentials never appear in plaintext in any log)

The only context where decryption occurs is server-side, during an authorized get_credential call from an agent with a valid bearer token and the correct service in its access profile.

What "connecting a service" does

When you connect a service:

You paste your API key or complete OAuth
The server receives the plaintext value over TLS
The server encrypts it with AES-256-GCM using the vault key
The ciphertext and nonce are written to the database
The plaintext is discarded from memory

There is no "view credential" feature. If you need to see a stored credential value, you must retrieve it via get_credential using a valid agent token — which is logged.

Encryption key management

See Encryption model for key details. The critical operational constraint: the VAULT_ENCRYPTION_KEY must never change after setup. Key rotation requires re-encrypting every stored credential — a manual migration that must be planned carefully.

OAuth credentials

For OAuth-connected services (Stripe OAuth, Google OAuth, etc.), Gazebo stores both the access token and the refresh token in the vault. Refresh tokens are re-encrypted if rotated. The OAuth flow never exposes tokens to the browser after the initial connection.

Credentials are stored in the Gazebo vault — a PostgreSQL table where every value is encrypted at rest with AES-256-GCM before being written.

Storage model

Each credential entry stores:

user_id — which account owns this credential
service — the service name (e.g. stripe)
ciphertext — the AES-256-GCM encrypted credential value
nonce — the random nonce used for this encryption (required for decryption)
created_at, updated_at

The plaintext credential value is never written to the database.

Zero-plaintext guarantee

After a credential is stored, its plaintext value is never returned to any web client. This applies to:

The Settings page in the dashboard (shows connection status, not the credential)
The API (no endpoint returns plaintext credentials to authenticated web sessions)
Error messages and logs (credentials never appear in plaintext in any log)

The only context where decryption occurs is server-side, during an authorized get_credential call from an agent with a valid bearer token and the correct service in its access profile.

What "connecting a service" does

When you connect a service:

You paste your API key or complete OAuth
The server receives the plaintext value over TLS
The server encrypts it with AES-256-GCM using the vault key
The ciphertext and nonce are written to the database
The plaintext is discarded from memory

There is no "view credential" feature. If you need to see a stored credential value, you must retrieve it via get_credential using a valid agent token — which is logged.