# Keyring

> Deploy and operate Keyring, the credential-holding proxy

- [Composio Keyring](https://keyring.docs.composio.dev/index.md): Add customer-controlled encryption and policy checks to credential use in Composio.
- [How Keyring works with Composio](https://keyring.docs.composio.dev/concepts/how_it_works.md): Follow a tool call through Composio, your Keyring, your KMS, and the provider.
- [Credential refresh and exchange](https://keyring.docs.composio.dev/concepts/credential_refresh.md): See how Composio refreshes provider credentials through your Keyring without receiving plaintext tokens.
- [Encryption and key hierarchy](https://keyring.docs.composio.dev/concepts/encryption_and_keys.md): Understand the customer-owned keys that protect credentials at ingress, storage, and use.
- [Security model](https://keyring.docs.composio.dev/security/security_model.md): Trust boundaries, customer controls, cryptography, fail-closed behavior, and residual risks.
- [Network and request policy](https://keyring.docs.composio.dev/security/network_and_policy.md): How Keyring limits inbound callers, provider destinations, token operations, redirects, and secret placement.
- [Origin allowlist](https://keyring.docs.composio.dev/security/origin_allowlist/overview.md): How Keyring keeps each credential within its approved toolkit destinations and protects token operations.
- [Audit and observability](https://keyring.docs.composio.dev/security/audit_and_observability.md): Record every credential use, tool call, and token operation in customer-owned telemetry.
- [Deployment overview](https://keyring.docs.composio.dev/deployment/overview.md): Choose where to run Keyring, deploy it for your Composio organization, and connect your projects.
- [Set up telemetry delivery](https://keyring.docs.composio.dev/deployment/observability.md): Send Keyring audit events, logs, traces, and metrics through a collector or direct OTLP endpoint.
- [Deploy on AWS ECS](https://keyring.docs.composio.dev/deployment/aws_ecs.md): Run Keyring on Fargate with an ECS task role, private tasks, and Composio-only ingress.
- [Deploy on GCP Cloud Run](https://keyring.docs.composio.dev/deployment/gcp_cloud_run.md): Run Keyring with Cloud Run service identity, Cloud KMS, and Cloud Armor ingress.
- [Deploy with Docker](https://keyring.docs.composio.dev/deployment/docker.md): Run the published distroless Node image with a mounted encryption configuration.
- [Deploy on Kubernetes](https://keyring.docs.composio.dev/deployment/kubernetes.md): Install the Node image with Helm, Kubernetes Secrets, probes, and hardened pod defaults.
- [Deploy to Cloudflare Workers](https://keyring.docs.composio.dev/deployment/cloudflare_workers.md): Run Keyring on a globally distributed serverless platform with Worker secrets and managed scaling.
- [Deploy to Vercel](https://keyring.docs.composio.dev/deployment/vercel.md): Run Keyring as a managed Vercel function with project secrets and automatic scaling.
- [Runtime configuration](https://keyring.docs.composio.dev/configuration/runtime.md): Reference for every environment variable, its default, validation, and runtime scope.
- [Encryption configuration](https://keyring.docs.composio.dev/configuration/encryption.md): Reference for the complete ENCRYPTION_CONFIG structure and its validation rules.
- [KMS and Vault adapters](https://keyring.docs.composio.dev/configuration/kms_adapters.md): Configure AWS KMS, GCP Cloud KMS, HashiCorp Vault, and local development adapters.
- [Helm values reference](https://keyring.docs.composio.dev/configuration/helm.md): Reference for every value exposed by the Keyring Helm chart.
- [Health and troubleshooting](https://keyring.docs.composio.dev/operations/health_and_troubleshooting.md): Verify Keyring and diagnose network, authentication, policy, KMS, and audit failures.