Credentials and trust boundaries

These credentials are separate. A browser session cannot register a workspace; a runtime token cannot access Redis; an A2A token cannot call Manager APIs.

Credential	Bound to	Accepted by	Where the raw value appears
Browser session	Signed-in user	Manager product API	Browser cookie
Workspace bootstrap	One workspace startup	Manager registration once	Read-only runtime bundle
Runtime access and refresh	One registered workspace	Manager runtime API	Workspace process memory
Tenant Redis credential	One tenant	Redis ACL and namespace	Mounted bundle / runtime
GitHub installation token	One authorized repository	Git and GitHub API	Short-lived workspace process
A2A pair token	One ticket pair	Nexus relay	Paired worker parameters

Registration and rotation

Manager hashes bootstrap, access, and refresh credentials in PostgreSQL. Registration atomically consumes the one-time bootstrap. The runtime uses its access token on Manager calls. When it receives an authorization failure, it rotates the refresh token and retries once. The refresh family has a fixed maximum lifetime.

GitHub credential broker

sequenceDiagram
    participant W as Tenant workspace
    participant M as Manager broker
    participant P as PostgreSQL
    participant G as GitHub App
    W->>M: Runtime token + purpose git or api
    M->>P: Validate workspace, tenant and repository
    M->>G: Sign App request and mint installation token
    G-->>M: Short-lived scoped token
    M->>P: Record encrypted credential lease
    M-->>W: Short-lived token for authorized repository

Brokered GitHub token exchange

View diagram source

sequenceDiagram
    participant W as Tenant workspace
    participant M as Manager broker
    participant P as PostgreSQL
    participant G as GitHub App
    W->>M: Runtime token + purpose git or api
    M->>P: Validate workspace, tenant and repository
    M->>G: Sign App request and mint installation token
    G-->>M: Short-lived scoped token
    M->>P: Record encrypted credential lease
    M-->>W: Short-lived token for authorized repository

The runtime calls POST /api/v1/runtime/github-credentials with purpose git or api. Manager derives the repository, installation, and permission profile from the authenticated workspace. It signs a GitHub App request using the server-held private key, validates the returned scope, records a lease, and returns a short-lived installation token.

Hosted GitHub operations use the App installation identity. A person signs in with GitHub to access OpenFlows and connect the organization; that OAuth login is not the credential Forge uses to push a branch.

What a compromised workspace can see

A running workspace can read its own bootstrap bundle, tenant Redis credential, current runtime session, and any short-lived GitHub token it has requested. Treat it as a credential-bearing execution environment. It does not receive the Manager master key, GitHub App private key, global Coder operator credential, or another tenant's Redis password.

Operational boundary

Short-lived tokens reduce exposure; they do not make a compromised workspace harmless. Network access, workspace isolation, revocation, audit, and credential rotation remain necessary.