---
title: "Credential Storage | Gazebo Docs"
description: "How Gazebo stores API keys and OAuth tokens — encrypted vault, zero-plaintext return policy, and the never-rotate guarantee."
url: "https://gazebohq.com/docs/security/credential-storage"
---

Credentials are stored in the Gazebo vault — a PostgreSQL table where every value is encrypted at rest with AES-256-GCM before being written.

## Storage model

Each credential entry stores:

- `user_id` — which account owns this credential
- `service` — the service name (e.g. `stripe`)
- `ciphertext` — the AES-256-GCM encrypted credential value
- `nonce` — the random nonce used for this encryption (required for decryption)
- `created_at`, `updated_at`

The plaintext credential value is never written to the database.

## Zero-plaintext guarantee

After a credential is stored, its plaintext value is never returned to any web client. This applies to:

- The Settings page in the dashboard (shows connection status, not the credential)
- The API (no endpoint returns plaintext credentials to authenticated web sessions)
- Error messages and logs (credentials never appear in plaintext in any log)

The only context where decryption occurs is server-side, during an authorized `get_credential` call from an agent with a valid bearer token and the correct service in its access profile.

## What "connecting a service" does

When you connect a service:

1. You paste your API key or complete OAuth
2. The server receives the plaintext value over TLS
3. The server encrypts it with AES-256-GCM using the vault key
4. The ciphertext and nonce are written to the database
5. The plaintext is discarded from memory

There is no "view credential" feature. If you need to see a stored credential value, you must retrieve it via `get_credential` using a valid agent token — which is logged.

## Encryption key management

See [Encryption model](/docs/security/encryption) for key details. The critical operational constraint: the `VAULT_ENCRYPTION_KEY` must never change after setup. Key rotation requires re-encrypting every stored credential — a manual migration that must be planned carefully.

## OAuth credentials

For OAuth-connected services (Stripe OAuth, Google OAuth, etc.), Gazebo stores both the access token and the refresh token in the vault. Refresh tokens are re-encrypted if rotated. The OAuth flow never exposes tokens to the browser after the initial connection.