Configuration
Configure a CipherStash workspace for local development and production: the workspace CRN, client and access keys, and keyset selection.
A workspace is identified by its CRN and accessed with a client key and an access key. How those credentials reach your application differs between local development and production.
Credentials
Choose a credential source
Use the developer profile locally. For CI or a deployed application, create a separate credential set with the CLI or Dashboard.
Run:
npx stash auth loginThe native Stack client uses the developer profile automatically.
What the deployment variables mean
| Credential | Description |
|---|---|
| Workspace CRN | Identifies your workspace and its region, for example crn:ap-southeast-2.aws:your-workspace-id |
| Client ID | Identifies your application client key |
| Client key | Your half of the dual-party key split |
| Access key | Authenticates API calls to CipherStash |
These are the same credentials the Stack SDK and Proxy consume. For build-time availability, environment separation, and production rollout gates, see Deployment.
Keysets
A workspace can hold many keysets. Data encrypted under one keyset cannot be decrypted with another, which is what makes keysets the boundary for tenant isolation, environment separation, and regional compliance.
To use a specific keyset, pass the keyset option when constructing the client:
const client = await Encryption({
schemas: [users],
config: {
keyset: { name: "tenant-a" },
},
})Proxy scopes keysets per connection instead. See multitenant operation.
Related
- Key management for the isolation model.
- Billing for the plans and how per-workspace billing works.