Tokenized Tokens

Summary

Fly.io describes a security problem in its Rails-based platform: as the application accumulated secrets, Rails became the part of the attack surface least trusted, yet still handled many operations involving bearer tokens. It compares model encryption, Vault or KMS, and narrowly scoped secret-handling services, noting that each leaves gaps or creates operational overhead when secrets must be read for arbitrary third-party APIs. The proposed Tokenizer is a stateless HTTP proxy holding a Curve25519 private key; encrypted secrets travel in Proxy-Tokenizer headers, and the proxy injects plaintext or computes HMACs while host allowlists constrain misuse. A companion SSOkenizer performs OAuth2 flows outside Rails, tokenizes resulting bearer tokens, and returns credentials usable only through Tokenizer. The tools are open source, and the design provides a path for third-party integrations and SSO without adding raw secrets to Rails.

Takeaways

1. 1

   Tokenizer lets Rails store and pass encrypted secrets without possessing the private key needed to decrypt or use them directly.

2. 2

   Proxy-Tokenizer headers carry encrypted secrets and rewrite instructions; secrets can be injected into headers or used to HMAC selected request parts, with allowed hosts limiting misuse.

3. 3

   SSOkenizer keeps the OAuth2 exchange in Go code, converts resulting bearer tokens into Tokenizer-compatible credentials, and enabled OAuth2 logins for additional providers with little extra work.