Security1 min read

Security

Identity, encryption, signature verification, and secure operations for OpsKnight

This section covers identity management, cryptographic data protection, webhook signature verification, and secure operations for OpsKnight.

In This Section

Guide Description
OIDC SSO Setup Configure single sign-on with Google, Okta, Azure AD, and Keycloak
Envelope Encryption AES-256-CBC envelope encryption for integration secrets and tokens
Webhook Verification HMAC-SHA256 signature verification and timing-safe payload validation

Key Concepts

  • Authentication is handled by NextAuth.js with OIDC support. See Authentication for the full guide.
  • Encryption at rest uses AES-256-CBC envelope encryption. The master key is supplied via the ENCRYPTION_KEY environment variable.
  • Signature Verification ensures incoming webhooks from Datadog, GitHub, Sentry, Grafana, and generic webhooks originate from authenticated senders and protects against tampering or replay attacks.
  • Authentication — Local auth, SSO, sessions, and security settings
  • Audit Logs — Security event tracking and compliance
Previous← Mobile PWANextOIDC SSO Setup →

Last updated for v1.3

Edit this page on GitHub