Vault and security

Secrets are written only on the website. Desktop Cockpit hydrates them after Sign in.

Web-only writes

Paste secrets on /settings while signed in with a browser session, or import a YAML template in one shot. PUT, POST, and DELETE on /api/vault require a first-party Clerk cookie and reject Authorization: Bearer — even if a cookie is also present. There is no bulk unauthenticated import API. The desktop must not try to write the vault.

YAML import

Download /vault-template.yaml (orca-cockpit-vault.biscuit.yaml), fill the known keys, then Import on Settings. A flat map of the same keys is also accepted. Empty strings are skipped; unknown keys are ignored. Treat the file like a password and delete it after import.

What the desktop can do

After PKCE Sign in, Orca Cockpit receives a short-lived Clerk session JWT and GETs /api/vault. Bearer GET returns a CloudVaultDocument (cursor.credentials + anypoint.connectedApp, and optional Salesforce / GitHub / Postman). Values are not shown again on the website after save.

Known keys

Required for Ask: cursor_api_key, anypoint_client_id, anypoint_client_secret, anypoint_org_id.
Optional Salesforce: salesforce_client_id, salesforce_client_secret, salesforce_instance_url.
Optional loop: github_token, postman_api_key.

Storage

Secrets are AES-256-GCM sealed into Clerk private metadata (vault). They are never written to public metadata. This is not zero-knowledge and not a hardware module. Treat GET-by-key responses as secret. Clerk private metadata is small — keep tokens short.