Per-client API key vault (AES-256-GCM)

L1 master key: RAG_MASTER_ENCRYPTION_KEY or DPAPI file — never in DB. L2: encrypted keys in DB. L3: background resync decrypts without a user. RAG UI · Swagger

Step 1 — Register a key
Step 2 — Keys in DB (prefix only)
No data loaded.
Step 3 — Scenarios
Step 4 — Audit trail
No audit loaded.
Operation log
Ready.