1. Two kinds of secret
1) SSO token: issued on the fly, HMAC signed, expires in about 60 seconds, used only to open ecosystem apps. 2) Factory vault: username and password for legacy systems, stored per user, encrypted in the database, never listed in plain text in the catalog.
2. Factory vault (how it works)
When opening a registered app for the first time, FormiOS asks for username and password. The password is encrypted (libsodium secretbox) and saved in formios_user_app_credentials, tied to user_id. The listing only shows whether a credential exists — not the password.
3. What the session controls
Every catalog and SSO API requires a FormiOS login (session user_id). Without a valid session there is no credential read or write. SSO app grants (user_external_apps) limit who can open each integrated system.
4. Company best practices
Do not share a generic password across the team — each person saves their own in the vault. Prefer SSO (level 2) when the system accepts tokens. Rotate legacy passwords and have users update them in the FormiOS modal. Admins must not request passwords over chat or email.
5. Current limits (transparency)
Vault key comes from FORMIOS_VAULT_KEY in the environment. get_credentials returns the password only to the authenticated owner on the open flow — not to third parties. 60-second SSO tokens reduce reuse window if a URL leaks.
6. Hardening roadmap
Key rotation playbook, vault access audit (who opened what and when), option to update without re-displaying password, and company policy to forbid vault where SSO already exists.
7. What not to do
Store passwords in spreadsheets or WhatsApp. Use one shared legacy account for a whole department. Open critical apps outside the desktop. Disable HTTPS in production.