Credential vault

Delegate operations, not upstream secrets.

Business Owners store encrypted credentials and authorize exact operations for verified API-key or OAuth-client identities.

Operation-bound credentials

Open Credentials as an Owner. Supply a public HTTPS API base, OpenAPI JSON contract, explicit operation names and Bearer, API-key-header, Basic, OAuth client-credentials or OAuth browser/PKCE configuration. Secrets are sealed, never shown again. Rotation changes the credential version and revokes all derived grants. Deletion, disconnect and grant revocation remain available after downgrade.

Provider browser connection and refresh

Configure explicit authorization/token URLs, client ID, exact scopes and a public/no-secret, client_secret_post or client_secret_basic authentication method. Register the callback displayed in the dashboard. Connect renders a provider link for human login, consent and 2FA; Knotbind never collects provider passwords/2FA codes. Ten-minute S256 PKCE state binds to the initiating member and credential version, and is consumed in a committed transaction before token exchange. Pages/callbacks prevent caching and referrer leakage. Optional exact issuer configuration requires a matching iss response.

Access/refresh tokens stay sealed and are never vended. Authorized execution refreshes expiring access under a shared-database exclusive account lock before dispatch; concurrent instances do not rotate the same refresh token twice. Successful refresh cannot extend Owner consent or expand scopes. Refresh failure, missing material or an invalid response clears tokens/grants and requires reconnect. Reconnect invalidates old operation grants; the Owner must approve new consent. No API operation is automatically replayed. Access defaults to one hour when omitted by the provider and is capped locally at 24 hours. Real provider sign-in/2FA remains unperformed by local fixtures.

Explicit consent and expiry

Select a workspace API key or an already-consented OAuth client/member with tool:execute. Choose exact operation names and 15-60 minutes. Writes need explicit Owner approval and tool:execute:write. OAuth binding uses stable client ID plus member ID, so token refresh does not extend consent. Credential expiry caps grant expiry. Only execution-token hashes persist; expired consent requires a new Owner grant.

Before a granted call leaves Knotbind, an argument that contains the stored upstream credential, a control character, a reserved header, or a single-dot or double-dot path segment is rejected. A hosted write still pauses for the one-time Owner approval on OpenAPI to MCP. Vault consent does not skip that pause.

Vend and execute

curl -X POST https://www.knotbind.com/api/v1/vault/grants/GRANT_ID/token -H "Authorization: Bearer $AGENT_CREDENTIAL"

curl -X POST https://www.knotbind.com/api/v1/vault/grants/GRANT_ID/execute -H "Authorization: Bearer $AGENT_CREDENTIAL" -H "X-Knotbind-Execution-Token: $EXECUTION_TOKEN" -H "Content-Type: application/json" -d '{"operation":"list_customers","arguments":{}}'

Both requests require the approved identity. Rotation revokes the old execution token without changing its deadline. The Gateway alias /v1/credential-grants/{id}/execute enforces the same checks. Calls validate arguments, never accept arbitrary URLs, use bounded guarded HTTP, and never retry. Known credential echoes are redacted. Audit logs record identity, credential ID, grant and attempted operation, never secrets or arguments.

Safety boundaries

50 credentials and 100 active grants per account; token rotation 30/minute, vault execution 60/minute and four shared active tool slots across app instances using the same PostgreSQL database. OAuth connection starts are capped at ten/minute and callbacks at thirty/minute per account. Account transaction locks coordinate explicit access changes with execution; revocation waits for already-dispatched calls instead of pretending to cancel provider writes. Worker-failure slot leases expire after 120 seconds. The memory adapter and standalone packages remain process-local. This vault does not return provider tokens or certify real-assistant/production acceptance.