COMPANY ADMINISTRATION
Token Vault
Manage the credentials that keep company integrations connected. Saved values stay masked in the Cloudflare password vault.
Initializing secure sign-in…
Credentials are organized into collapsible groups. Use Move to group on any card to reorganize it without changing or rotating its saved token.
Credentials managed outside Token Vault
These security keys and generated sessions are intentionally not editable as ordinary tokens:
- Vault encryption keyring (
VAULT_KEYS) — retained and rotated through Cloudflare Secrets Store recovery procedures. - Xero session encryption key (
XERO_COOKIE_KEY) — rotating it invalidates saved accounting sessions. - Web Push VAPID private keys — generated and preserved per environment; rotation invalidates device subscriptions.
- License certificate encryption key (
EXTENSION_CERTIFICATE_KEK) — created and preserved by the License Server deployment. - Extension verification certificates — managed from Licensing → Certificates because they are bound to extension IDs and products.
- OAuth access and refresh tokens — renewed automatically and encrypted in their owning service.
Runtime-linked replacements apply on the next authorized request. Approved pipelines retrieve their credential from the active card version; pipeline runs add audit events rather than creating new cards. Previous versions remain nested under their card. Existing provider sessions may continue until they renew. Saving does not verify a credential with its provider.