Authentication
APIFold uses a layered authentication approach: Clerk for user identity and AES-256-GCM for credential encryption.
Dashboard Authentication (Clerk)
The dashboard and all API endpoints (except health checks and webhooks) require authentication via Clerk.
Supported Sign-In Methods
- Email + password
- Google OAuth
- GitHub OAuth
Protected Routes
The Next.js middleware protects these route patterns:
/api/*(except/api/healthand/api/webhooks/*)/dashboard/*
Marketing pages (/, /pricing, /docs) are publicly accessible.
Session Management
Clerk handles session tokens automatically. Sessions are short-lived JWTs validated on every request. No session data is stored server-side.
Credential Vault
API keys and bearer tokens for upstream APIs are encrypted at rest using the credential vault.
Encryption Details
| Property | Value |
|---|---|
| Algorithm | AES-256-GCM |
| Key Derivation | PBKDF2 (100,000 iterations) |
| IV | Random 12-byte per encryption |
| Auth Tag | 128-bit GCM authentication tag |
How Credentials Flow
- Storage: When you add a credential, the plaintext key is encrypted with
VAULT_SECRET+VAULT_SALTand stored as ciphertext - Retrieval: When the MCP runtime needs to call your upstream API, it decrypts the credential in memory
- Rotation: Credentials can be deleted and re-added at any time. Old ciphertext is permanently removed from the database
Environment Variables
| Variable | Description | Generation |
|---|---|---|
VAULT_SECRET | Master encryption key (min 32 chars) | openssl rand -base64 48 |
VAULT_SALT | Key derivation salt (32-char hex) | node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" |
Zero-Knowledge Design
- Plaintext credentials never touch disk or logs
- The vault key (
VAULT_SECRET) is never stored alongside encrypted data - Decrypted credentials exist only in process memory during upstream API calls
- Self-hosters control both the vault key and the database
MCP Transport Authentication
MCP servers support three auth modes for client connections:
| Mode | Description | Use Case |
|---|---|---|
none | No authentication required | Local development, trusted networks |
api_key | Clients must send an API key header | Shared team access |
bearer | Clients must send a Bearer token | Production deployments |
Configure the auth mode when creating or editing a server in the dashboard.