Credential Bridge

All API keys and secrets are encrypted at rest with AES-256-GCM before storage. Raw values never appear in chat, logs, LLM context, or analytics.

How credential security works
Secret entry mode: When BOSS activates secret entry mode, the input field becomes a masked password field. Your entry is displayed as ***secret*** in the transcript and sent only to the Credential Store — never to the AI chat endpoint.
AES-256-GCM encryption: Credentials are encrypted before writing to disk. The encryption key is derived from the environment. Plaintext secrets are never written to any file.
Live key rejection: Keys containing live_ or pk_live_ or rk_live_ are automatically rejected unless you explicitly allow live keys with owner authorization.
7-tier classification: Every credential is classified: SANDBOX_SECRET, LIVE_SECRET_OWNER_APPROVAL_REQUIRED, MCP_TOKEN, API_KEY, PASSWORD_OR_LOGIN_SECRET, PAYMENT_SECRET, or OTHER_SECRET.
No AI exposure: Raw secret values never reach /api/chat, LLM endpoints, audit logs, error messages, or screenshots.
How to add credentials
Option 1 — BOSS Chat: Type “Add Stripe API key” or “Connect OpenAI key” in BOSS Chat. BOSS will activate secure entry mode automatically.
Option 2 — Tools & Apps Registry: Open Tools & Apps and click “Connect” on any tool. The credential bridge modal will open.
Option 3 — Owner Activation: The Owner Activation page has vendor-specific setup cards with the Sandbox Credential Bridge.

Owner / Operator Credentials

Open BOSS ChatTools & Apps RegistryOwner Activation