> ## Documentation Index
> Fetch the complete documentation index at: https://keyring.docs.composio.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment overview

> Choose where to run Keyring, deploy it for your Composio organization, and connect your projects.

export const DeploymentAuthConfig = () => {
  const [organizationId, setOrganizationId] = useState("");
  const audience = organizationId || "YOUR_COMPOSIO_ORG_ID";
  const configuration = `APP_ENV=production
AUTH_JWKS_URL=https://backend.composio.dev/.well-known/jwks.json
AUTH_ISSUER=https://backend.composio.dev
AUTH_AUDIENCE="${audience}"
AUTH_JWT_ALGORITHMS=RS256`;
  const inputClassName = "mt-2 w-full rounded-lg border-2 border-zinc-950/20 bg-white px-3 py-2.5 font-mono text-sm text-zinc-950 shadow-sm outline-none transition placeholder:text-zinc-400 hover:border-zinc-950/35 focus:border-blue-500 focus:ring-2 focus:ring-blue-500/20 dark:border-white/20 dark:bg-zinc-950 dark:text-white dark:placeholder:text-zinc-500 dark:hover:border-white/35";
  return <div className="deployment-auth-config not-prose my-6 space-y-4">
      <div>
        <label className="block text-sm font-semibold text-zinc-900 dark:text-zinc-100">
          Enter your Composio organization ID
          <input type="text" value={organizationId} onChange={event => setOrganizationId(event.target.value)} className={inputClassName} placeholder="ok_example123456" autoComplete="off" spellCheck={false} />
        </label>
        <p className="mb-0 mt-1.5 text-xs text-zinc-500 dark:text-zinc-400">
          The command below updates when you enter a value.
        </p>
      </div>

      <CodeBlock language="bash" filename="Keyring authentication configuration" wrap>
        {configuration}
      </CodeBlock>
    </div>;
};

Composio publishes Keyring as a Docker image for AMD64 and ARM64. You decide where it runs and control
its networking, KMS access, scaling, monitoring, and upgrades.

One Keyring deployment serves one Composio organization. We recommend using a separate Composio
organization for testing before connecting your production organization.

## Choose where to run Keyring

AWS ECS and Google Cloud Run are our preferred production platforms. Both provide managed compute and
short-lived workload identity for access to your KMS.

<Columns cols={2}>
  <Card title="AWS ECS on Fargate (preferred)" icon="https://upload.wikimedia.org/wikipedia/commons/9/93/Amazon_Web_Services_Logo.svg" href="/deployment/aws_ecs">
    Deploy with an ECS task role and AWS KMS.
  </Card>

  <Card title="Google Cloud Run (preferred)" icon="https://cdn.simpleicons.org/googlecloud/4285F4" href="/deployment/gcp_cloud_run">
    Deploy with a Cloud Run service identity and Google Cloud KMS.
  </Card>
</Columns>

<Columns cols={2}>
  <Card title="Docker" icon="https://cdn.simpleicons.org/docker/2496ED" href="/deployment/docker" horizontal>
    Run the published image on your container platform.
  </Card>

  <Card title="Kubernetes" icon="https://cdn.simpleicons.org/kubernetes/326CE5" href="/deployment/kubernetes" horizontal>
    Deploy the image with the supported Helm chart.
  </Card>

  <Card title="Cloudflare Workers" icon="https://cdn.simpleicons.org/cloudflareworkers/F38020" href="/deployment/cloudflare_workers" horizontal>
    Deploy the supported Worker runtime without Docker.
  </Card>

  <Card title="Vercel" icon="https://cdn.simpleicons.org/vercel/737373" href="/deployment/vercel" horizontal>
    Deploy the supported Vercel runtime without Docker.
  </Card>
</Columns>

Container deployments use `composiohq/keyring:alpha`. Cloudflare Workers and Vercel deploy the
supported repository runtime directly because those platforms do not run the container image.

## Before you deploy

Your platform guide walks through the provider-specific steps. Every production deployment needs:

* a KMS or Vault that only the Keyring workload can use;
* a public HTTPS endpoint restricted to Composio traffic;
* the production Composio authentication values below; and
* [durable audit delivery](/deployment/observability) plus health monitoring.

Open [Project Settings → General](https://dashboard.composio.dev/~/project/settings/general#:~:text=%40org_id)
and copy your organization ID. Organization IDs look like `ok_example123456`.

<DeploymentAuthConfig />

The platform guide provisions the required encryption keys and stores the complete
`ENCRYPTION_CONFIG` in its secret manager. Use workload identity instead of a long-lived cloud key.
See [Encryption and key hierarchy](/concepts/encryption_and_keys) when you need the underlying key
model.

## Network access

Keyring needs a public HTTPS hostname, but it does not need to accept traffic from the entire internet.
Permit TCP 443 from only these Composio production egress addresses:

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
34.233.50.61/32
54.224.131.195/32
54.243.138.89/32
52.72.72.59/32
```

Keep JWT verification enabled behind this allowlist. The network rule restricts the source, while the
signed JWT binds each request to your Composio organization. The Composio Dashboard does not need a
direct network path to Keyring.

<Warning>
  Confirm the egress list through your Composio support channel before changing a production
  firewall. Review additions or replacements as security-policy changes.
</Warning>

Keyring needs outbound HTTPS access to the Composio JWKS endpoint, your KMS or Vault, approved provider
origins, and your [telemetry destination](/deployment/observability). The official image includes the
reviewed Composio toolkit policy, so a standard deployment does not need a remote policy manifest.

## Connect Keyring to Composio

After Keyring is available at its HTTPS endpoint, open
[Project Settings → Keyring](https://dashboard.composio.dev/~/project/settings/keyring). Add the Keyring
URL for your organization, then enable Keyring for each project that should use it.

Existing credentials continue working as they do today. They move to Keyring only when you ask Composio
to migrate them, and the Composio team can assist with that migration.

## Verify the deployment

Check the public endpoint before enabling a project:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl --fail https://keyring.example.com/healthz
curl --fail https://keyring.example.com/readyz
curl --fail https://keyring.example.com/transfer-keys
```

Then use a connected account or run a tool that requires one. A successful flow produces a Keyring
request with a request ID without logging the credential value.

If the connection fails, use [health and troubleshooting](/operations/health_and_troubleshooting) to
check the public path, organization audience, KMS identity, and audit collector.

<Note>
  Infrastructure identity authorizes access to your KMS. It does not replace request authentication.
  Keyring still verifies a signed Composio token and provider policy on every credential operation.
</Note>