Vault + desktop sign-in: how Orca Cockpit hydrates secrets

The biscuit-week rule is blunt: the website writes secrets, the desktop reads them. That split is why consultants can take Cockpit into a bank or government program without a password in a chat transcript.

Write on /settings

Vault fields live in Clerk private metadata, AES-256-GCM sealed. The Settings form uses your browser cookie. You can paste field by field or Import a YAML template (download /vault-template.yaml). API mutations reject Bearer tokens on purpose. If Electron tried to PUT a key, the site answers 403 and points at /settings.

Sign in is PKCE, not a pasted JWT

The app opens /desktop/authorize with client_id=cockpit-electron. You sign in with Clerk on orcaesb.com. The site redirects to http://localhost:{port}/callback with a one-time code. The app exchanges it at /api/desktop/token and holds a short-lived session JWT.

Hydrate, then hide

Bearer GET /api/vault returns the CloudVaultDocument desktop already parses (mapped secrets, not the website knownKeys list). The website UI never redisplays the secret after save. Rotate the Connected App if a laptop walks away.

What to vault first

• Cursor API key — required for Ask.
• Anypoint Connected App — required to see the tenant.
• Salesforce / GitHub / Postman — only if Day 4 of your trial needs them.