How your channel credentials are protected
The access NioConnect holds for your channels is sealed in an encrypted vault, never shown again after you save it, and removed when you disconnect.
Last updated- Connect a channel as usual. Fields that take a secret are masked as you type.
- Save. The value is encrypted at once and is not shown again, not even to you.
- To end access, disconnect the channel in NioConnect, or revoke it on the platform.
How the vault works
Channel credentials are encrypted with AES-256-GCM under a separate key for each workspace, held in a key management service rather than in a setting. They are never returned by any API and never written to a log, and tools that watch our logs redact anything shaped like a token. If a key cannot be read, you see a plain failure on our side, never a leak.
Your NioConnect sign-in is a different thing from a channel credential and the two are never mixed: sessions use httpOnly cookies, passwords are stored with a modern hash and sign-in attempts are rate limited. Our security page summarises the same design, and How credentials are sealed is the long version.
Cutting access
Disconnect in a channel's details deletes the stored access; you will need to authorize again. Disable keeps it. On the platform side, deleting a Bluesky app password, sending /revoke to BotFather, or removing NioConnect from a Mastodon server's authorized apps cuts access without involving us. Nostr is the exception: a private key cannot be revoked, only abandoned, which is why a dedicated key is advised.
An API key or a connected AI client acts with the role of the member who made it, and every connection is listed under Developers where you can revoke it at once. Keys are shown only once.
If it did not work
If you lose a token, you cannot recover it from NioConnect, by design. Generate a new one on the platform and reconnect. If a channel stops working after you revoke something, that is the revoke working; see A channel needs reconnecting. Everything that changes access is recorded in the audit log.