How BYO keys and secrets are protected and never returned to the browser

If you bring your own provider keys or store project secrets, HIIE encrypts them at rest and never sends the raw values back to your browser.

Account-level BYO keys

You can supply your own Composio and OpenRouter keys at the account level. These live in an account-scoped, AES-GCM-encrypted credentials blob in a separate Vault bucket. When you view them, the interface returns only a masked status showing the last 4 characters — never the full key. You can save (encrypted) or delete them, and they're read server-side only. An active OpenRouter BYO key flags your account as BYO, so those runs are unmetered and free on your own account.

Project secrets (Environment)

Each project has an encrypted secrets editor (Software → Environment) for API keys and environment variables. Values are stored with AES-256-GCM under a project-scoped key in the project's Misc/env.json. Reading them returns only masked hints (dots followed by the last 4 characters); the full values never come back to the browser.

Composio environment keys

The Connections → Environment view shows which Composio key mode your account runs under (your own, a dedicated project key, the shared managed fallback, or none) with a health badge. For BYO and dedicated-project keys, only a masked hint is shown, and the resolved key is never sent to the browser or logged. Dedicated project keys can be rotated.

The principle

Across all of these, the rule is consistent: secrets are encrypted at rest, used only server-side, and surfaced to you only as masked hints. This is AES-GCM at rest, not end-to-end encryption — but the raw key material stays off the client.