Ephemeral credential tokens

IdentityDashboardMCPformat: passwordeph:v1lt_ephemeral_credentialsescalate_and_waitexchangeTokensInArgs

A password typed into a form reaches the tool as an opaque token, exchanged for plaintext only at the moment of the call.

The situation

A pipeline needs a one-time vendor password to finish. A person can supply it, but the value must not land in workflow state, logs, or the model’s context.

The recipe

Mark the field as a password in the form the workflow sends:

{
  "role": "ops",
  "message": "Enter the vendor portal password to finish order ORD-1042.",
  "form_schema": {
    "type": "object",
    "properties": { "password": { "type": "string", "format": "password" } },
    "required": ["password"]
  }
}

The dashboard renders a masked input.
On submit, the resolve endpoint encrypts each password value (AES-256-GCM) into lt_ephemeral_credentials and replaces it with eph:v1:password:<uuid>.
The workflow, and any model reading the resolver data, sees only the token.
When a tool is about to run, the argument tree is walked and each eph:v1: string is exchanged for plaintext in the activity callback.

Property	Value
Format	`eph:v1:<label>:<uuid>`
Default TTL	900 seconds
Max uses	Unlimited by default, configurable

The guarantee

No plaintext persists: the row is deleted after its TTL or its last use, and each exchange increments use_count atomically. Exchange happens at the last moment before dispatch, in the MCP tool executor, the triage executor and compiled pipeline workers. An expired token passes through unchanged and the receiving tool rejects it, which is a safe failure. See Identity.

The escalation boundary