Credentials and workspaces
Each workspace has its own storage connection, API keys, pipelines, usage, and billing.
What you need
| Credential | Purpose | Lifecycle |
|---|---|---|
| Maskura API key | Required for S3, SDK, and direct object requests. | The access ID and secret are workspace-bound. The secret is shown once and can be revoked. |
| Storage credentials | Required for Maskura to access your AWS S3 or Backblaze B2 bucket. | Enter them when connecting or replacing storage. Saved values remain hidden. |
| MCP token | Optional authentication for an MCP client. | Shown once and revoked separately from API keys. |
| Encryption key pair | Optional field encryption for writes that use an envelope-encryption pipeline. | Generated in your browser. Maskura receives only the public key; you keep the private key. |
Workspace isolation
API keys, MCP tokens, storage connections, and pipeline assignments can access only the workspace where they were created. Usage and billing are tracked for the same workspace.
Recommended setup
- Connect your AWS S3 or Backblaze B2 bucket.
- Create one Maskura API key and store its secret securely.
- Create an MCP token only when connecting an MCP client.
- Add an encryption key pair only when your write pipeline encrypts fields.
See Storage and Envelope Encryption for detailed setup.