Credentials and secrets
A Knot credential stores a secret (API key, partner SMTP password, webhook secret) encrypted. The engine decrypts only during a run, without showing the value in user-facing logs.
🔐 Encryption
- Algorithm: AES-256-GCM.
- Master key: environment variable or server secret (not in Git).
- No plain values in
llx_knot_*exposed to the UI.
🔐 Common types
| Type | Example |
|---|---|
| AI provider | OpenAI / Anthropic key |
| HTTP Bearer | SaaS API token |
| Basic auth | Partner user/password |
| Webhook secret | Inbound HMAC |
Reference credentials by ID in nodes; .knot.json export excludes secrets.
🔐 Rotation
- Create a new credential with the fresh key.
- Update each affected node.
- Simulate, then a control manual run.
- Revoke the old key at the provider.
- Delete the old Knot credential.
If a webhook secret leaks, regenerate URL too if your process requires it.
🔐 Best practices
- Least privilege on API tokens.
- No secrets in tickets, email, or doc screenshots.
- Separate prod / staging (credentials, instances).
🔐 Audit log
Use audit log for:
- credential create / update / delete;
- who activated a workflow using a secret;
- correlation with Failed runs (without leaking the secret in messages).
Application logs mask sensitive headers (SecretMasker in the product).