Docs
Kiwi Fabric
Version Current

Configuration reference

Credential storage

Where Kiwi Fabric keeps the key that encrypts data-source credentials, and how to choose a backend.

Fabric Current 1 min read Updated

Data-source passwords and other secrets are never stored in plaintext. They are encrypted before they reach the registry. The only choice is where the encryption key lives, and that is selected with one configuration switch and no code changes.

Backend When to use it
Local machine-key store (default) Development and simple installs. A start-up warning is logged so choosing it is a conscious decision
Azure Key Vault Deployments on Azure
AWS Secrets Manager Deployments on AWS
GCP Secret Manager Deployments on Google Cloud

For production, prefer a cloud secret manager so the key is not tied to a single machine.

  • API keys are stored only as SHA-256 hashes.
  • Exports made with kiwi fabric export are encrypted with a passphrase you supply, so a backup file does not expose credentials.
  • The AI assistant API key you pass to ai-config-set is stored like other secrets and is returned only as a masked hint.