> ## Documentation Index
> Fetch the complete documentation index at: https://keyring.docs.composio.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Composio Keyring

> Add customer-controlled encryption and policy checks to credential use in Composio.

export const RequestTraceDiagram = () => <figure className="keyring-diagram simple-request-flow tool-call-flow">
    <div className="simple-request-flow__stage" role="img" aria-label="An agent makes a Gmail tool call to Composio. Composio resolves the provider endpoint and attaches the sealed credential envelope from its database. Inside Keyring, your KMS unseals the token, the authorized request reaches Gmail, and a credential-free response returns through Composio to the agent.">
      <div className="tool-call-flow__segment tool-call-flow__segment--one" aria-hidden="true" />
      <div className="tool-call-flow__segment tool-call-flow__segment--two" aria-hidden="true" />
      <div className="tool-call-flow__segment tool-call-flow__segment--three" aria-hidden="true" />

      <div className="simple-request-flow__nodes tool-call-flow__nodes">
        <div className="simple-request-flow__node tool-call-flow__node--agent">
          <span className="simple-request-flow__node-mark tool-call-flow__node-mark--agent">
            <svg viewBox="0 0 24 24" aria-hidden="true">
              <rect x="3" y="4.5" width="18" height="15" rx="2.4" />
              <path d="m7 10 2.8 2.4L7 14.8" />
              <path d="M12.6 15H17" />
            </svg>
          </span>
          <b>Agent</b>
          <span className="simple-request-flow__node-caption">Your app</span>
        </div>
        <div className="simple-request-flow__node tool-call-flow__node--composio">
          <span className="simple-request-flow__node-mark simple-request-flow__node-mark--composio" aria-hidden="true" />
          <b>Composio</b>
        </div>
        <div className="simple-request-flow__node tool-call-flow__node--keyring">
          <span className="simple-request-flow__node-mark simple-request-flow__node-mark--keyring">
            <svg viewBox="0 0 24 24" aria-hidden="true">
              <path d="M12 3 5 6v5c0 4.5 2.8 7.5 7 9.5 4.2-2 7-5 7-9.5V6L12 3Z" />
              <circle cx="12" cy="11" r="2" />
              <path d="M12 13v3" />
            </svg>
          </span>
          <b>Keyring</b>
          <span className="simple-request-flow__node-caption">Your Cloud</span>
        </div>
        <div className="simple-request-flow__node tool-call-flow__node--gmail">
          <span className="simple-request-flow__node-mark simple-request-flow__node-mark--gmail">
            <svg viewBox="0 0 32 24" aria-hidden="true">
              <path d="M3 21 V6" />
              <path d="M3 6 L16 15 L29 6" />
              <path d="M29 6 V21" />
              <path d="M3 6 L8 9.5" />
            </svg>
          </span>
          <b>Google</b>
        </div>
      </div>

      <div className="simple-request-flow__kms-link tool-call-flow__db-link" aria-hidden="true" />
      <span className="tool-call-flow__db-envelope" aria-hidden="true">
        <svg viewBox="0 0 24 24">
          <rect x="3" y="5.5" width="18" height="13" rx="2" />
          <path d="M4.5 7.5 12 13l7.5-5.5" />
          <circle cx="12" cy="15.4" r="1.4" />
        </svg>
      </span>
      <div className="simple-request-flow__kms tool-call-flow__db">
        <span className="simple-request-flow__node-mark tool-call-flow__node-mark--db">
          <svg viewBox="0 0 24 24" aria-hidden="true">
            <ellipse cx="12" cy="6" rx="7" ry="2.7" />
            <path d="M5 6v12c0 1.5 3.1 2.7 7 2.7s7-1.2 7-2.7V6" />
            <path d="M5 12c0 1.5 3.1 2.7 7 2.7s7-1.2 7-2.7" />
          </svg>
        </span>
        <b>Composio DB</b>
        <span className="simple-request-flow__node-caption">Sealed envelopes</span>
      </div>

      <div className="simple-request-flow__kms-link tool-call-flow__kms-link" aria-hidden="true" />
      <div className="simple-request-flow__kms-packet tool-call-flow__kms-packet" aria-hidden="true" />
      <div className="simple-request-flow__kms tool-call-flow__kms">
        <span className="simple-request-flow__node-mark simple-request-flow__node-mark--kms">
          <svg viewBox="0 0 24 24" aria-hidden="true">
            <circle cx="7.5" cy="12" r="3.5" />
            <path d="M11 12h10m-3 0v3m-3-3v2" />
          </svg>
        </span>
        <b>KMS</b>
      </div>

      <div className="tool-call-flow__packet" aria-hidden="true">
        <div className="tool-call-flow__payload tool-call-flow__payload--call">
          <svg viewBox="0 0 24 24" aria-hidden="true">
            <rect x="3" y="4.5" width="18" height="15" rx="2.4" />
            <path d="m7 10 2.8 2.4L7 14.8" />
            <path d="M12.6 15H17" />
          </svg>
          <span>GMAIL_LIST_EMAILS</span>
        </div>
        <div className="tool-call-flow__payload tool-call-flow__payload--request">
          <svg viewBox="0 0 24 24" aria-hidden="true">
            <circle cx="12" cy="12" r="8" />
            <ellipse cx="12" cy="12" rx="3.4" ry="8" />
            <path d="M4 12h16" />
          </svg>
          <span className="tool-call-flow__endpoint" />
          <b className="tool-call-flow__token">
            <span className="tool-call-flow__token-label">Token:</span>
            <span className="tool-call-flow__token-value" />
          </b>
        </div>
        <div className="tool-call-flow__payload tool-call-flow__payload--response">
          <svg viewBox="0 0 24 24" aria-hidden="true">
            <circle cx="12" cy="12" r="8" />
            <path d="m8.5 12.2 2.4 2.4 4.6-4.8" />
          </svg>
          <span>23 New Emails</span>
        </div>
      </div>
    </div>
  </figure>;

Composio Keyring adds your infrastructure to the security path for every credential use. Keyring runs
in your infrastructure, uses your KMS for customer-controlled protection, and stores no credential
database.

Credentials for custom auth configs stay encrypted beyond Composio's reach. Composio-managed
credentials are unusable at rest and must pass through your Keyring before use. Requests forwarded
through Keyring are separately restricted to approved destinations.

<Note>
  Your tool calls stay the same. Composio Connect URLs and hosted web flows seal credentials
  automatically. Direct SDK support for credential submission and auth config changes is coming
  soon.
</Note>

<RequestTraceDiagram />

## What you gain

<div className="keyring-gains">
  * **Monitoring:** See everything entering and leaving Keyring. Send logs and
    [audit events](/security/audit_and_observability) to your monitoring stack.
  * **Control:** Disable specific toolkits or projects and add
    [custom request rules](/security/network_and_policy) for your organization.
  * **Credential protection:** Credentials for
    [custom auth configs](https://docs.composio.dev/docs/authentication/custom-app-vs-managed-app) stay
    encrypted beyond Composio's reach. Composio-managed credentials must pass through your Keyring
    before Composio can use them, making them unusable at rest.
  * **Breach impact:** Composio cannot open stored credentials by itself, while Keyring stores no
    credential database. Compromising either system alone does not expose credentials at rest.
</div>

<Info>
  Keyring will be open sourced. Customers can inspect its safeguards, including the origin manifest
  that defines approved provider destinations.
</Info>

## Get started

<Columns cols={2}>
  <Card title="Understand Keyring" icon="shield-check" href="/concepts/how_it_works">
    See what changes in the credential trust model and follow a tool call from Composio to a
    provider.
  </Card>

  <Card title="Deploy Keyring" icon="rocket" href="/deployment/overview">
    Deploy one Keyring instance for your Composio organization, register its URL, and enable
    projects.
  </Card>
</Columns>