Hookfish stores API keys and other non-OAuth credentials in its encrypted
secret vault. Your application refers to each key by a stable resource path.
Store an API key
Hookfish encrypts the value with OAUTH_ENCRYPTION_KEY before writing it to the
database.
Use the API key
Retrieve secrets only in trusted server code:
Pass apiKey to the provider’s server-side SDK. Hookfish marks decrypted
responses as no-store; do not return the value to browser code or write it to
logs.
List and delete API keys
Listing returns paths and timestamps without decrypting values:
Prefix matching respects path-segment boundaries. A prefix of acme/tools
does not match acme/toolsmith. Scoped broker tokens can access only paths
covered by their resource scopes.
Keep vault operations in authenticated server routes. Paths below
__hookfish/ are reserved for Hookfish’s internal credentials.