Orbiton never stores your raw API keys. Every secret is encrypted, every access is logged, and every mutation is role-guarded. Here is exactly how we protect your data.
Your provider API keys (OpenAI, Anthropic, etc.) are encrypted the moment they enter our system. They are only decrypted server-side, in memory, for the duration of a single proxy request.
Self-Hosted Encrypted Format
base64(IV) : base64(authTag) : base64(ciphertext)Each encrypted value includes a random initialization vector and authentication tag, making every encryption unique even for the same input.
Instead of passing real provider keys to your agents, Orbiton issues virtual keys that act as secure proxies.
Virtual keys are stored as one-way SHA-256 hashes. Even if the database is compromised, the original key cannot be recovered.
The full virtual key is displayed exactly once after creation. After that, only the prefix (orb_live_...) is visible in the UI.
Every virtual key has a kill switch. Deactivate it instantly from the dashboard — no redeployment needed, no waiting.
Before any API call reaches a provider, it must pass through our multi-layer validation pipeline.
Virtual key extracted from Authorization header and verified against SHA-256 hash in the database.
If the key has been deactivated via the dashboard, the request is rejected immediately with 403.
Keys with expiration dates are checked. Expired keys cannot make any further requests.
Monthly spend is calculated against the key's budget cap. Over-budget keys are blocked before the request reaches the provider.
Per-key RPM limits enforced via token bucket algorithm. Org-level RPM caps based on plan tier. Headers returned: X-RateLimit-Limit, Remaining, Reset.
Real provider API key decrypted in memory only for the duration of the forwarding request. Never cached, never logged.
Request forwarded to the provider with real credentials. Usage logged asynchronously. Provider response returned unmodified.
Multi-layer access control ensures only the right people can see and modify your resources.
JWT-based session management with bcrypt password hashing. Optional OAuth (GitHub, Google). Middleware protects all dashboard routes.
Three-tier hierarchy: Owner > Admin > Member. Sensitive operations (credentials, invites, billing) require admin role. Owner cannot be removed.
Every query is scoped to the current organization. Users can only see and manage data belonging to their org. No cross-tenant data leakage.
Health check URLs are validated against private IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, ::1). Only HTTPS URLs are accepted for external checks.
Multiple layers of protection at the infrastructure and application level.
Security Headers
7 Headers
CSP, HSTS, X-Frame-Options, X-Content-Type, Referrer-Policy, Permissions-Policy, X-XSS-Protection
Webhook Signing
HMAC-SHA256
X-Orbiton-Signature header on all webhook deliveries
Rate Limiting
Dual Backend
In-memory for self-hosted, Upstash Redis for serverless
Error Handling
Zero Leakage
Generic errors to clients, detailed logs server-side only
CORS
Configurable
CORS_ALLOWED_ORIGINS env var for production origin control
Stripe Webhooks
Verified
Official Stripe SDK signature verification on all events
Input Validation
Defense Layer
Email format, password strength, URL length limits, private IP blocking
Environment
Server-Only
No NEXT_PUBLIC_ secrets. All sensitive vars are server-only
Test Coverage
147+ Tests
Crypto, RBAC, rate limiting, proxy, security hardening, and more
Security is as much about what you don't do as what you do.
Provider keys are encrypted at rest immediately. Virtual keys are SHA-256 hashed. No plaintext keys anywhere in the database.
All provider credentials are decrypted server-side only. Client components never receive or handle real API keys.
API keys, passwords, and tokens are excluded from all logs. Error messages are generic on the client, detailed only in server logs.
The proxy forwards your requests and returns provider responses unmodified. No injection, no filtering, no data collection on content.
Self-hosted Orbiton gives you 100% data sovereignty. Your keys, your server, your encryption secret.
Quick Start
git clone https://github.com/your-org/orbiton cd orbiton cp .env.example .env.local # Set DEPLOYMENT_MODE=self-hosted # Set ENCRYPTION_SECRET (64 hex chars) docker compose up -d