---
title: "Tokenized Tokens"
description: "Fly.io describes a security problem in its Rails-based platform: as the application accumulated secrets, Rails became the part of the attack surface least trusted, yet still handled many operations involving bearer tokens. It compares model encryption, Vault or KMS, and narrowly scoped secret-handling services, noting that each leaves gaps or creates operational overhead when secrets must be read for arbitrary third-party APIs. The proposed Tokenizer is a stateless HTTP proxy holding a Curve25519 private key; encrypted secrets travel in Proxy-Tokenizer headers, and the proxy injects plaintext or computes HMACs while host allowlists constrain misuse. A companion SSOkenizer performs OAuth2 flows outside Rails, tokenizes resulting bearer tokens, and returns credentials usable only through Tokenizer. The tools are open source, and the design provides a path for third-party integrations and SSO without adding raw secrets to Rails."
---

# Tokenized Tokens

[Fly.io](https://yomu.fyi/company/fly-io) · Jul 12, 2023

**Type:** Problem & solution

## Summary

Fly.io describes a security problem in its Rails-based platform: as the application accumulated secrets, Rails became the part of the attack surface least trusted, yet still handled many operations involving bearer tokens. It compares model encryption, Vault or KMS, and narrowly scoped secret-handling services, noting that each leaves gaps or creates operational overhead when secrets must be read for arbitrary third-party APIs. The proposed Tokenizer is a stateless HTTP proxy holding a Curve25519 private key; encrypted secrets travel in Proxy-Tokenizer headers, and the proxy injects plaintext or computes HMACs while host allowlists constrain misuse. A companion SSOkenizer performs OAuth2 flows outside Rails, tokenizes resulting bearer tokens, and returns credentials usable only through Tokenizer. The tools are open source, and the design provides a path for third-party integrations and SSO without adding raw secrets to Rails.

## Context

Fly.io wanted to prevent its Rails API from handling additional secret material, because Rails was the part of its attack surface it trusted least. Third-party integrations required bearer tokens, while OAuth2 login flows briefly exposed credentials to Rails; existing approaches either could not support arbitrary services or required cumbersome, dedicated services.

## Approach / What changed

Tokenizer is a stateless HTTP proxy that decrypts secrets encrypted to a Curve25519 public key and uses them to rewrite proxied HTTP requests, including header injection and selective HMAC generation. Host allowlists restrict where individual secrets may be sent. SSOkenizer performs OAuth2 flows outside Rails, tokenizes the resulting bearer tokens, and supplies those tokens to Rails for use through Tokenizer.

## Takeaways

- Tokenizer lets Rails store and pass encrypted secrets without possessing the private key needed to decrypt or use them directly.
- Proxy-Tokenizer headers carry encrypted secrets and rewrite instructions; secrets can be injected into headers or used to HMAC selected request parts, with allowed hosts limiting misuse.
- SSOkenizer keeps the OAuth2 exchange in Go code, converts resulting bearer tokens into Tokenizer-compatible credentials, and enabled OAuth2 logins for additional providers with little extra work.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Go](https://yomu.fyi/topic/go), [OAuth2](https://yomu.fyi/topic/oauth2), [Security](https://yomu.fyi/topic/security)

- Source: [Fly.io](https://fly.io/blog/tokenized-tokens)
- Source URL: https://fly.io/blog/tokenized-tokens
- Ingested by Yomu: 2026-09-02T11:57:22.289Z

[Read original post](https://fly.io/blog/tokenized-tokens)