Keys & the Vault
Oxrion uses a few kinds of keys and secrets. Oxrion Desktop keeps them in the Vault: one encrypted file, protected by one password, that stays on your computer.
Key types
Section titled “Key types”| Type | What it’s for | Used in |
|---|---|---|
| Encoder Key | Identifies your account to the Encoder. Starts with oxe_. Get it from the Oxrion Console. | Encoder |
| License keypair | Public key binds files to licenses; private key signs licenses. | Encoder (public), Licenser (private) |
| Recovery keypair | Public key makes files recoverable; private key restores them. | Encoder (public), Recovery (private) |
| External key | The secret your server needs for Server lock. | Encoder, and your server’s environment |
| Email password (SMTP) | The password of an email account used to send licenses. | Email & Hooks |
| Webhook secret | Signs webhook deliveries so your server can verify them. | Email & Hooks |
You can generate license and recovery keypairs, external keys and webhook secrets in the Vault, or paste ones you already have.
Where each key goes
Section titled “Where each key goes”Keys are only used for their own purpose:
| Key | Sent to |
|---|---|
| Encoder Key | Oxrion, to identify your account when you protect |
| External key | Oxrion’s Encoder when you protect with Server lock — used to protect the files, then discarded |
| Public keys (license, recovery) | Oxrion’s Encoder when you protect — they are embedded in the files |
| Email password (SMTP) | Your own email provider, when sending an email |
| Private keys (license, recovery) | Nowhere — used only on your computer |
| Webhook secret | Nowhere — only used to sign requests on your computer |
Public and private keys
Section titled “Public and private keys”License and recovery keys come in pairs.
- The public key is safe to share. It goes into the Encoder when you protect, and is embedded in the protected files.
- The private key is secret. It stays in your Vault and is used only on your computer — to sign licenses or restore source.
Losing a private key means you can no longer issue licenses for files protected with its public key (license keypair) or restore those files (recovery keypair). Anyone who has it can do both. Treat private keys like passwords.
The Vault file
Section titled “The Vault file”The Vault is a single .vault file stored wherever you choose. You can create a new one or open an existing one from Oxrion Desktop.
- One password protects it. Choose a strong one; Oxrion Desktop shows a strength meter. The password can’t be recovered — if you forget it, the Vault can’t be opened.
- It locks itself. After 10 minutes without use (you can choose 5, 10 or 30 minutes, or never) the Vault locks and the keys are wiped from memory. You can also press Lock at any time.
- Defaults save typing. You can mark one Encoder Key, license key, recovery key and external key as the default. Oxrion Desktop then selects it automatically where it’s needed.
Back it up
Section titled “Back it up”Copy the .vault file somewhere safe — another disk, a password manager, an encrypted backup. Because the file is encrypted, a copy is as safe as the original, as long as your password is strong. To use your keys on another computer, copy the file there and open it. See Data & privacy.