Bring your own key
In the local app, Pi will read your own provider credential from its credential store on the machine. The local app will need no muniment cloud key and send no provider credential to the paid console. In the paid console, the console owner will store provider keys once for every paid route to use. No user machine will hold a company key.
These features will be available at launch. muniment is not generally available. The rest of this guide describes the paid console.
Set the credential
The console owner will set provider keys in the Models area of the paid console.
How the provider vault holds it
The paid console’s provider vault will encrypt each provider key at rest and keep it off user machines.
Each tenant will have its own subdomain. The paid console will keep each tenant’s provider keys, records, and policy separate. The provider vault runbook covers deployment-key operations.
Audit records
The audit records guide explains which actions create records.