Credentials

A credential in PastKeys is the provider's root secret (a Cloudflare token, an AWS key, a GitHub App key, a database admin DSN) sealed to your broker. Agents never receive it. For each operation the broker either mints a narrow, short-lived credential from it or uses it broker-side.

Sealing

You seal the secret to the broker's public key with pastkeys seal on a trusted machine, then store the resulting blob in the dashboard. The control plane keeps only that ciphertext. Each credential has a provider and an ID (default root).

Credential lifetime by provider

Where a provider can mint a narrow, short-lived credential, the broker mints one per operation. Where it cannot, the broker uses the sealed long-lived token directly: it never leaves the broker and runs with least privilege, but it is not time-boxed. Prefer a minting provider, or set a short credential_ttl where minting is available.

Provider	Credential type	What the broker uses	Lifetime
AWS	Minted, short-lived	STS AssumeRole session, optional inline session policy	15 minutes
GitHub	Minted, short-lived	App installation token scoped to one repo and the least permission	~1 hour (fixed by GitHub)
Postgres	Minted, short-lived	Temporary login role inheriting a read-only base role	15 minutes
Cloudflare	Minted when enabled, else sealed long-lived	Per-call token scoped to one zone and the action (opt-in with CLOUDFLARE_TOKEN_MINT=1), otherwise the sealed zone token	15 minutes minted, otherwise the token's own lifetime
Generic HTTP	Sealed long-lived	The sealed token, injected broker-side, no minting	The token's own lifetime

Minting is the default for AWS, GitHub and Postgres. For Cloudflare it is opt-in, so the default there is the sealed long-lived token. A generic HTTP API cannot mint a narrower credential, so it is always the sealed token. In every case the sealed token stays broker-side and the agent receives only the operation result.

Minted credentials are cached for their lifetime (minus a safety margin) and dropped if an operation fails, so a revoked credential is re-minted.

Setting the lifetime per rule

A policy rule can set credential_ttl (10s to 12h) so a destructive action runs on a credential that dies quickly:

{"provider": "cloudflare", "resource": "example.com",
 "actions": ["DNS_DELETE"], "credential_ttl": "2m"}

Providers with a fixed or minimum lifetime clamp to it (AWS minimum 15 minutes, GitHub fixed at 1 hour). The audit record always shows the lifetime actually issued.