> ## Documentation Index
> Fetch the complete documentation index at: https://keyring.docs.composio.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption configuration

> Reference for the complete ENCRYPTION_CONFIG structure and its validation rules.

`ENCRYPTION_CONFIG` defines three mandatory key purposes plus optional DEK caching and origin policy. JSON is accepted everywhere; the long-lived Node target also accepts a path to JSON or YAML.

## Complete shape

```yaml theme={"theme":{"light":"github-light","dark":"github-dark"}}
credential:
  active_adapter_id: credential-provider
  active_key_id: credential-root-key
  adapters:
    credential-provider:
      type: <aws | gcp_cloud_kms | hashicorp_vault | development_only_in_memory>
      # provider-specific fields

authorization_gate:
  active_adapter_id: gate-provider
  active_key_id: authorization-gate-root-key
  adapters:
    gate-provider:
      type: <provider type>
      # provider-specific fields

secret_transfer:
  active_kid: transfer-2026-01
  adapters:
    transfer-provider:
      type: <provider type>
      # maps one or more kid values to asymmetric keys

dek_cache:
  capacity: 256
  ttl_seconds: 600

origin_policy:
  manifest_url: https://policy.example.com/origin-manifest.json
```

## Top-level fields

| Field                | Required | Meaning                                                                                                                                                                                |
| -------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `credential`         | Yes      | Symmetric key providers used for DEKs that encrypt provider credentials and exchange response fields.                                                                                  |
| `authorization_gate` | Yes      | Separate symmetric key providers used for the optional outer authorization/consent envelope.                                                                                           |
| `secret_transfer`    | Yes      | Asymmetric RSA providers used to open JWE credentials sealed by the Composio Dashboard with a public key forwarded by the Composio backend.                                            |
| `dek_cache`          | No       | Process/isolate-local cache for non-extractable unwrapped DEKs. Defaults to capacity 256 and TTL 600 seconds when configured without explicit values. If omitted, caching is disabled. |
| `origin_policy`      | No       | Remote origin manifest source. If omitted, the manifest compiled into the application is always enforced.                                                                              |

## Symmetric section fields

Both `credential` and `authorization_gate` use the same structure:

| Field                           | Meaning                                                                                                                 |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `active_adapter_id`             | Map key in `adapters` used to wrap newly generated DEKs                                                                 |
| `active_key_id`                 | Provider key reference used by the active adapter for new DEKs                                                          |
| `adapters`                      | Map of stable adapter IDs to provider configurations; retain historical adapters while old DEK envelopes reference them |
| `adapters.<id>.allowed_key_ids` | Non-empty allowlist of provider keys this adapter may use for wrap or unwrap                                            |

The active adapter must exist, and its allowlist must contain the active key.

## Transfer section fields

| Field                | Meaning                                                                          |
| -------------------- | -------------------------------------------------------------------------------- |
| `active_kid`         | Opaque public identifier Composio forwards for new Dashboard-sealed JWE payloads |
| `adapters`           | Map of stable, globally unique adapter IDs to asymmetric provider configurations |
| `adapters.<id>.keys` | For production providers, map from `kid` to a provider asymmetric-key reference  |

Every `kid` must be unique across transfer adapters, and `active_kid` must be present. The development adapter uses `kids` because it generates ephemeral key pairs itself.

## Global validation rules

Configuration loading fails if:

* adapter IDs overlap between either symmetric section or the transfer section;
* a provider key reference is shared between `credential` and `authorization_gate`;
* a transfer key reference is also used as a symmetric root key;
* an active adapter, active key, or active transfer `kid` is missing; or
* a provider-specific field, URL, key name, credential mode, or auth method is invalid.

These rules make the adapter ID embedded in an envelope unambiguous for its full lifetime.

## Origin policy

`origin_policy.manifest_url` selects a remote manifest. Standard Composio customer deployments should omit it because the reviewed toolkit manifest is compiled into the current image. If Composio supplies a custom manifest URL, use HTTPS; Keyring rejects a non-HTTPS manifest URL in `production`. The manifest is validated and cached for 60 seconds. A fetch or validation failure fails the affected request.

Leave the field absent to use the bundled snapshot. The startup log annotation `config.origin_policy.source` identifies `bundled` or `remote`.

## Config storage guidance

<Tabs>
  <Tab title="Node">
    Prefer a read-only mounted YAML file. Node reads and validates it before listening, so
    configuration or credential-resolution failures fail startup.
  </Tab>

  <Tab title="Cloudflare">
    Store compact JSON in the `ENCRYPTION_CONFIG` Worker secret for each Wrangler environment. File
    paths are unsupported.
  </Tab>

  <Tab title="Vercel">
    Store compact JSON in a sensitive project environment variable. File paths are unsupported by
    the Vercel entry's cold loader.
  </Tab>
</Tabs>

<Warning>
  Any config containing AWS keys, a GCP private key/access token, or a Vault token/AppRole secret ID
  is itself a secret. Prefer workload identity on Node/Kubernetes so the config contains only
  identifiers.
</Warning>