Vault limits and FAQ
Size limits for vault connections and secrets in the beta, and answers to common questions about how credentials are stored, injected and rotated.
Limits
| Limit | Value |
|---|---|
| Bound hosts per custom connection | 8 |
| Connection request body | 64 KiB |
api_key, password, client_secret | 8 KiB each |
token, access_token, refresh_token | 16 KiB each |
label | 80 characters |
subject | 256 characters |
| Connections per sandbox grant | 16 |
| Connections named in one action call | 8 |
FAQ
No. Secret fields are write-only: the API returns their names, never their values, and never logs them. To change one, write a new value with PATCH.
At the egress proxy on the node, after the request leaves the action, routine or sandbox and before it goes out to the service. It is added only when the destination is one of the connection's hosts.
Holding a secret that B3OS checks but never sends, such as the signing secret a provider uses for webhooks to a routine. It has no hosts, so it is never injected into any request.
Yes, for example one per end user with subject. Name the one you want in each call; when you leave it out, B3OS uses the project's only connection for that pack and key, and a routine step uses the most recent one the run may use.
Not in v0.1. Store an access token you obtained yourself as an oauth2 connection. Hosted consent links are planned.