Secrets and tokens

Status: Current | Last reviewed: 2026-10-01

TrueServe stores three kinds of secrets on your behalf: integration credentials, tool secrets, and API tokens you mint for outside systems to call you. This page is the user-facing summary of how that works, what you can and cannot see, and how to rotate.

What's encrypted

Stored item Where Visible to you
Integration API keys, OAuth refresh tokens Encrypted in the integrations vault No — write-only
Tool secrets (per-tool extra credentials) Encrypted, scoped to the tool No — write-only
API tokens you mint for outbound use Hashed on save Once at creation, never again
Conversation transcripts At rest, tenant-scoped Yes, with the Manage Agents permission

The platform's master encryption key is held by TrueServe operators. If you delete the platform's secrets vault, every encrypted secret is unrecoverable — you re-enter them.

API tokens

Some workflows call TrueServe from outside (a webhook from a partner system, a Salesforce Apex callout, a custom script). Those callers authenticate with an API token.

To create a Personal Access Token:

  1. Open Profile → Settings.
  2. In Personal Access Tokens, click Create token.
  3. Pick an expiry. Prefer a real expiry.
  4. Click Create.
  5. Copy the token now. You cannot see it again — TrueServe stores only a hash.

Personal tokens do not have a scope picker. TrueServe derives the token's access from your current permissions in the active tenant. If your access is later reduced, the token's access is reduced too.

Tokens look like tsf_….

Tenant API tokens created under Settings → API Tokens have a scope picker:

  1. Open Settings → API Tokens.
  2. Click Create token, then enter a name and optional description.
  3. Select only the scopes the integration needs and choose an expiry.
  4. Click Create token and copy the secret from the one-time reveal.

For an external demo app that lists published agents and launches the embedded phone, select only Read Agents and Run Emulator. Manage Agents also works and implies both scopes, but grants substantially more access than this integration needs.

For the SCV accent service, select only Accent Runtime (accent:runtime). This resolves the enabled tenant accent profile and provider credentials for a trusted backend. Keep it server-side. It does not grant general agent or settings access, and personal tokens do not gain this scope automatically.

Rotating

Best practice is to rotate tokens and integration credentials regularly. When you rotate:

  1. Mint the new credential.
  2. Switch the consuming system to the new credential.
  3. Verify the consumer is healthy.
  4. Revoke a personal token, or delete the old tenant token from Settings → API Tokens.

Doing it in that order avoids downtime — the brief overlap where both work is intentional.

Compromised credentials

If you suspect a token or integration credential has leaked:

  1. Open the credential.
  2. Click Revoke for a personal token, or Delete for a tenant token.

Revocation is immediate. Mint a replacement and roll forward.

For a leaked OAuth refresh token, you may also need to revoke the upstream OAuth grant — the platform's reconnect flow shows you the right button per provider.

What administrators can do

Tenant administrators with the Manage Configuration permission can create tenant tokens and permanently delete any listed tenant token from Settings → API Tokens, including ones they didn't mint. A deleted token stops working immediately and disappears from the table. Administrators cannot read token values after the one-time reveal.

See also