Settings

Credentials the console uses to read Coframe core · admin only · applies to the whole fleet, not one project

settings loaded 0s ago
Connection
Valid
verified 6m ago
last call to Coframe core
Access scope
3orgs
viewer · read-only
what the credential can see
Stored key
cfv1_4FBY…GtVE
set 12d ago
encrypted at rest · never returned
Answering now
Service token
stored key is the fallback
which credential is live

Coframe core credentials

used by directory sync and every monitoring read
API key

Stored encrypted with AES-GCM; the decryption key is a Worker secret (OPS_SETTINGS_KEY), so a database dump alone yields ciphertext. Write-only — no endpoint returns this value and the console keeps only the masked ends. Replacing it overwrites the old key immediately.

cfv1_4FBYGtVE set Jul 16 by [email protected]
Member ID

Identifies which Coframe member the console acts as when it calls /auth/me/memberships. Not a secret — stored in plaintext and safe to read back.

last changed Jul 16 by [email protected]

Verification

calls /auth/me/memberships with the stored key — the key is never echoed back
Valid — viewer on 3 orgs
HTTP 200 · 214ms · checked 6m ago by [email protected]
northwind-supplyatlas-outfittersverdant-home

Credential precedence

first one present wins
PY_SERVICE_TOKEN Worker secret · set by deploy · preferred whenever it is present in use
Stored key · cfv1_4FBY…GtVE Encrypted in D1 · takes over if the service token is unset or rejected standby

Reads that go through this chain: /api/v2/projects (directory sync) and /auth/me/memberships (scope check). Monitoring reads share the same client, so a bad credential here shows up as stale data everywhere else.

Credential activity

Verified — viewer on 3 orgs 6m ago · [email protected]
Member ID changed Jul 16 · [email protected]
API key set Jul 16 · [email protected]
Verify failed — HTTP 401 Jul 16 · [email protected]
API key set Jul 4 · [email protected]

Who can change this

ops admin · you
ops admin
ops admin

Everyone else on the console sees this page read-only, with the key masked the same way.