Secret Handling
How KorClaw protects secrets and transport URLs.
- API keys shown once at creation; stored hashed
- Agent keys stored as SHA-256 hash with last4 only
- MCP transport URLs masked in API responses
- Credential fields rejected in MCP server registration
- Upstream URLs never accepted in runtime API request bodies
- Webhook secrets use whsec_ prefix with HMAC-SHA256 signing