Riven Keymaster
LiveThe secret store for the whole platform. Keys, tokens, and provider credentials are sealed here and handed out by reference, never by value.
Keymaster holds every secret the platform depends on: Riven API key hashes, upstream provider credentials, mailbox passwords, database URLs, and signing material. Services request a secret by reference and receive it in memory for the life of the call.
The service is Riven Keymaster. References to a “Vault” in older diagrams or scripts describe this component under a name that is no longer used.
Rules it enforces#
- Write-only from the outside. A secret can be created or replaced through an authenticated call, but never read back in plaintext by a client.
- Reference, not value. Application config carries
keymaster://references; the resolved value exists only in the consuming process. - Hash, don’t store. Issued
rvn_API keys are stored as hashes. A lost key cannot be recovered, only rotated — which is why key rotation returns the new value exactly once. - Rotation is first-class. Every secret has a rotation path, and rotating one does not require a deploy.
- Access is logged. Every resolution is recorded with the requesting service and purpose in Riven Telemetry.
What consumes it#
| Consumer | Secret kind |
|---|---|
| Riven API | Issued key hashes for bearer verification |
| Riven Ultra Router | Upstream provider credentials for cloud fallback |
| Riven Auth | OIDC client secrets and session signing keys |
| Riven Mail | Mailbox credentials provisioned at signup |
| Riven ERP | Database and integration credentials |
| Riven Cortex | Per-tool credentials for outbound integrations |
Operating posture#
Keymaster is not on the public internet. It is reachable only on the internal overlay network behind Riven Edge Proxy, and it has no public API surface. There is no endpoint that returns a secret value to a browser.
If you need a credential for local work, rotate and receive a fresh one rather than trying to extract the existing value. Recovering the current value is not a supported operation by design.