Vault
Upstream credentials, loaded once, injected server-side at call time. Nobody downstream sees them.
Personal access tokens replaced
11
Imported PAT ban baseline plus every principal–server pairing now running on broker-issued tokens.
Active credentials
7
Ciphertext at rest; decrypted only in the gateway process.
Upstream credentials
| Credential | Kind | Server | Status | Last used | Added | |
|---|---|---|---|---|---|---|
| github-pat-legacy | API key | github | revoked | |||
| slack-bot-token | Bot token | slack | active | |||
| github-app | GitHub App | github | active | |||
| google-workspace-sa | Service account | google-workspace | active | |||
| notion-integration | Integration token | notion | activerotation due | |||
| stripe-restricted-key | API key | stripe | active | |||
| rippling-api-key | API key | rippling | active | |||
| hubspot-private-app | API key | hubspot | active |
Broker-issued agent tokens
What agents actually hold: scoped to one server and group, 8-hour lifetime, hash-only at rest, revocable mid-session.
| Token | Principal | Scope | Status | Issued | Expires | Last used | |
|---|---|---|---|---|---|---|---|
| ghk_1RPGZamO… | gtm-outreach | hubspot · gtm | active | ||||
| ghk_hIdcpMMv… | support-copilot | slack · support | active | ||||
| ghk_fnOTxs2O… | call-notetaker | notion · ops | expired | ||||
| ghk_h2NyVA60… | demo-scheduler | google-workspace · ops | expired | ||||
| ghk_c_eotIdC… | support-copilot | stripe · support | revoked |