Fluxo workflows can touch credentials, send messages, write to databases, and expose public review links. That means security is not an enterprise add-on. It is baseline infrastructure.
I designed Fluxo’s security model to be composable: authentication, organization scoping, RBAC, credential encryption, API keys, and signed webhooks all align to the same tenant boundary. When those layers agree, new features inherit the same guarantees instead of inventing their own rules.
Authentication and identity
Fluxo uses Better Auth with:
- email/password auth
- trusted social providers (Google, GitHub, Dropbox)
- account linking
- session-backed protected procedures
Every protected request resolves active organization context server-side before business logic. This prevents cross-tenant access bugs and keeps authorization logic consistent.
Credential vault
Credentials are encrypted at rest using an application encryption key before persistence. At runtime, decrypt happens only where needed for provider calls.
I also enforce credential type alignment so a node cannot accidentally use an incompatible credential class.
Access control layers
I enforce access at multiple levels:
- role-level guards (OWNER, ADMIN, PARTICIPANT, REVIEWER)
- asset-level selected permissions for workflows and credentials
- operation-level checks (view vs edit)
Reviewer role is constrained by design to avoid accidental privilege bleed.
API keys for programmable access
I implemented organization-scoped API keys with:
- hash-only storage
- one-time raw key reveal
- prefix display for management
- scopes (review read/write/approve and webhook scopes)
- revoke and expiry controls
Request auth uses bearer key verification, scope checks, and last-used timestamp updates.
Secure webhook delivery
Outgoing review webhooks are signed with HMAC SHA-256 per endpoint secret and include delivery ids. Delivery attempts are persisted with response status/body and retry metadata.
Signed review actions and sessions
For public review links and quick actions, I use hashed tokens with expiration and usage tracking. Session actions log actor label, IP, and user-agent for auditability.
Why this model scales
Security in Fluxo scales because it is consistent. Auth, org context, role checks, and tokenized external access all align to the same organization boundary. That consistency is what keeps new features secure by default.