Credential Vault & Connections

Automation nodes need credentials — API keys, database passwords, tokens. Beep.Skia keeps them out of the diagram itself in a credential vault, and resolves them by name at run time.

Credential Vault
Export and Import
Connection Manager
Security Properties

Credential Vault

The vault stores named entries of a type (API key, username/password, token, connection string, certificate) with optional metadata, and keeps the most recent update time per entry.

Storing and retrieving a credential

var vault = new CredentialVault("vault-passphrase");

vault.Set(new CredentialEntry
{
    Name = "crm-api",
    Type = CredentialType.ApiKey,
    Username = "integration",
    Secret = "sk-live-...",
    Metadata = { ["endpoint"] = "https://crm.example.com" }
});

var credential = vault.Get("crm-api");       // a copy, including the secret
foreach (var masked in vault.List())         // secrets masked for display
    Console.WriteLine($"{masked.Name}: {masked.Secret}");

Vault Members

Member	Type	Description
`CredentialVault(passphrase)`	ctor	Creates an in-memory vault; the passphrase enables encrypted export.
`Set(entry)`	`void`	Adds or replaces an entry by name.
`Get(name)`	`CredentialEntry`	Returns a copy including the secret, or null.
`Remove(name)`	`bool`	Deletes an entry.
`List()`	`IReadOnlyList<CredentialEntry>`	Entries with masked secrets, for display.
`Count`	`int`	Number of stored entries.
`Export()` / `Import(json)`	`string` / `void`	JSON round-trip; encrypted when a passphrase was supplied.

Credential Types

CredentialType values: ApiKey, UsernamePassword, OAuth2, Token, ConnectionString and Certificate. A CredentialEntry carries Name, Type, Username, Secret, free-form Metadata and UpdatedAt, and clones safely for hand-off.

Export and Import

Vaults travel between machines as JSON. With a passphrase the secrets are encrypted (AES with a PBKDF2-SHA256 derived key); without one they are written as-is for development only.

var json = vault.Export();                  // encrypted when a passphrase was supplied
File.WriteAllText("vault.json", json);

var restored = new CredentialVault("vault-passphrase");
restored.Import(File.ReadAllText("vault.json"));

Connection Manager

The connection manager keeps named connections (provider, endpoint, database, credential reference) and resolves the credential when a node needs to talk to a system, so diagrams reference crm-api rather than a password.

Member	Type	Description
`ConnectionManager(vault)`	ctor	Creates a manager; a vault is created automatically when none is supplied.
`Vault`	`CredentialVault`	The vault used to resolve credential references.
`Register(connection)`	`void`	Adds or replaces a named connection.
`Get(name)`	`AutomationConnection`	Returns the connection definition, or null.
`Remove(name)`	`bool`	Deletes a connection.
`Count`	`int`	Number of registered connections.

AutomationConnection carries Name, Provider, Endpoint, Database, CredentialName, a free-form Properties bag and UpdatedAt.

Registering a connection that points at a vault entry

var connections = new ConnectionManager(vault);

connections.Register(new AutomationConnection
{
    Name = "Sales",
    Provider = "SqlServer",
    Endpoint = "sql.internal:1433",
    Database = "Sales",
    CredentialName = "sales-db"          // resolved from the vault at use time
});

var connection = connections.Get("Sales");
var secret = connections.Vault.Get(connection.CredentialName)?.Secret;

Security Properties

No plaintext in exports — an encrypted export never contains the secret value.
Tamper detection — modified ciphertext is rejected on import rather than silently decrypting to garbage.
Wrong passphrase is an error — importing with the wrong passphrase fails loudly.
Masked by default — List() returns masked secrets for UI display; only Get() returns the real value, as a copy.
Thread-safe — concurrent workflows can read and write the vault safely.

Malformed vault documents (bad JSON, invalid base64 salt, missing passphrase for an encrypted export) are reported as clear errors instead of unexpected exceptions, and are covered by tests.

Table of Contents