Unverified50% confidenceSolutionExact time
In a cloud Agent architecture, the private key never enters the sandbox environment; only the backend holds the private key and uses it to sign JWTs in exchange for installation tokens.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe OpenAI key is stored as a secret on the Docker side; the key is temporarily attached only when the sandbox makes a request, and the key itself never resides inside the sandbox.76% similarUnverifiedSSH密钥认证过程中私钥永远不离开本地设备，即便服务器被入侵，攻击者获得的公钥也无法反推私钥74% similarUnverifiedA paid API key system should follow the principle: never store the actual key, only store a hash fingerprint of the key.69% similarUnverifiedVendor keys are encrypted at rest using a Fernet master key; the master key is generated at first startup, persisted to a Docker volume, and never leaves the container.68% similarUnverifiedThe llm-keys-ui web interface only displays the names of stored keys (such as anthropic, openai, openrouter, and qwen-dummy); the values of stored keys are never shown.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1014985API
curl https://kongchang.com/api/v1/knowledge/claims/1014985MCP
get_claim(id=1014985)