Integration key (vxi_)

How your server reads user data of apps with Encrypt user data: webhooks, the website API and API-key integrations.

What it is

When an app has Encrypt user data on, Vaultix no longer stores usernames, emails, names, notes, license keys, HWIDs and IP addresses readable. Your team reads them in the dashboard. Your own server reads them with the app’s integration key, vxi_…. Vaultix can’t: the key is made in the owner’s browser.

Key	Where it goes	What it opens
`vxi_…`	Your server only (environment variable)	User data in webhooks, the website API and integrations
`vxk_…`	Your app (SetContentKey)	Files, folders, variables and the logged-in user’s own name
`ap_… / vx_api_…`	As before	Access to the API, not the data

Get it

1
Turn on Encrypt user data
App Settings → Encrypt user data (owner only). New apps have it on. Existing data is sealed in the background; the card shows the progress.
2
Show the key
Click Show next to Integration key and confirm with your password. Copy it into your server’s secrets.
3
Update your server code
Open the sealed fields as shown below. Then turn on Require new app builds when all your clients are updated.

Where sealed values appear

The readable field is null and the value is in sealed (base64url). Each value is opened with the app ID and the field name.

Source	Sealed fields
Website API (/website/login, /website/me, /website/subscription)	user.sealed: username, email, name, and key where the API returned it
API-key integrations (connect poll, /connection, /connections)	user.sealed: the fields your key may read (username, name, note)
Webhooks	data.user {id, sealed}, data.sealed {description, actor}, data.changes[i].sealed {old, new}

Open a value

vaultix_vxi.pyPythonCopy

# pip install cryptography
import base64, hashlib, re
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey, X25519PublicKey
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives import hashes, serialization

def b64d(s): return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

def integration_secret(vxi):                 # "vxi_…" from App Settings
    raw = b64d(vxi[4:])
    assert len(raw) == 41 and raw[0] == 1 and hashlib.sha256(b"vaultix-vxi" + raw[:37]).digest()[:4] == raw[37:]
    return raw[1:33]

def open_field(vxi, app_id, field, sealed_b64u):
    sk = X25519PrivateKey.from_private_bytes(integration_secret(vxi))
    pk = sk.public_key().public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw)
    sealed = b64d(sealed_b64u); e_pk = sealed[1:33]
    ctx = b"udata\x00" + app_id.encode() + b"\x00" + field.encode()
    k = HKDF(hashes.SHA256(), 32, e_pk + pk, b"vaultix-zk1-seal\x00" + ctx).derive(
        sk.exchange(X25519PublicKey.from_public_bytes(e_pk)))
    return AESGCM(k).decrypt(bytes(12), sealed[33:], ctx).decode()

def change_field(name):                      # field of an audit change value
    return name if re.fullmatch(r"[a-z][a-z0-9.\-]{0,63}", name or "") else "change"

vaultixVxi.jsJavaScriptCopy

// Node 18+
const crypto = require('crypto');
const b64d = (s) => Buffer.from(s, 'base64url');

function integrationSecret(vxi) {
  const raw = b64d(vxi.slice(4));
  const check = crypto.createHash('sha256').update(Buffer.concat([Buffer.from('vaultix-vxi'), raw.subarray(0, 37)])).digest();
  if (raw.length !== 41 || raw[0] !== 1 || !check.subarray(0, 4).equals(raw.subarray(37))) throw new Error('invalid vxi_ key');
  return raw.subarray(1, 33);
}

const PKCS8 = Buffer.from('302e020100300506032b656e04220420', 'hex');
const SPKI = Buffer.from('302a300506032b656e032100', 'hex');

function openField(vxi, appId, field, sealedB64u) {
  const privateKey = crypto.createPrivateKey({ key: Buffer.concat([PKCS8, integrationSecret(vxi)]), format: 'der', type: 'pkcs8' });
  const pk = crypto.createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(-32);
  const sealed = b64d(sealedB64u);
  const ePk = sealed.subarray(1, 33);
  const ctx = Buffer.concat([Buffer.from('udata\0'), Buffer.from(appId), Buffer.from([0]), Buffer.from(field)]);
  const shared = crypto.diffieHellman({ privateKey, publicKey: crypto.createPublicKey({ key: Buffer.concat([SPKI, ePk]), format: 'der', type: 'spki' }) });
  const key = Buffer.from(crypto.hkdfSync('sha256', shared, Buffer.concat([ePk, pk]), Buffer.concat([Buffer.from('vaultix-zk1-seal\0'), ctx]), 32));
  const body = sealed.subarray(33);
  const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.alloc(12));
  decipher.setAAD(ctx);
  decipher.setAuthTag(body.subarray(body.length - 16));
  return Buffer.concat([decipher.update(body.subarray(0, body.length - 16)), decipher.final()]).toString('utf8');
}

UsagePythonCopy

# Integration endpoints (connect poll, /integration/connection, connections)
user = resp.json()["user"]
username = open_field(VXI, APP_ID, "username", user["sealed"]["username"])

# Webhooks
event = request.json
app_id = event["app"]["id"]
for field, value in event["data"].get("user", {}).get("sealed", {}).items():
    print(field, open_field(VXI, app_id, field, value))
for change in event["data"].get("changes", []):
    if (change.get("sealed") or {}).get("new"):
        new_value = open_field(VXI, app_id, change_field(change["field"]), change["sealed"]["new"])

Logins from your server

For these apps your server sends hashes instead of the license key and the password. Until the owner turns on Require new app builds, the raw values are still accepted (and converted), so you can update first.

Website API loginPythonCopy

import base64, hashlib, requests
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives import hashes

def b64e(b): return base64.urlsafe_b64encode(b).rstrip(b"=").decode()

def key_hash(key):
    return b64e(hashlib.sha256(b"vaultix-key-v1\x00" + key.encode()).digest())

def auth_hash(password, salt_b64u, iterations):
    salt = base64.urlsafe_b64decode(salt_b64u + "=" * (-len(salt_b64u) % 4))
    master = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, iterations, 32)
    return b64e(HKDF(hashes.SHA256(), 32, b"vaultix-enduser-login-v1", b"auth").derive(master))

headers = {"X-API-Key": "ap_web_your_website_key"}
requests.post(f"{BASE_URL}/website/login", headers=headers, json={"keyHash": key_hash("LICENSE_KEY")})

pre = requests.post(f"{BASE_URL}/website/prelogin", headers=headers, json={"username": "user"}).json()
body = {"username": "user", "authHash": auth_hash("password", pre["salt"], pre["iterations"])}
if pre["upgrade"]:
    body["password"] = "password"   # once: moves an older account to the new login
requests.post(f"{BASE_URL}/website/login", headers=headers, json=body)

Things to watch

Keep it on the server. Never put vxi_ in a game client, a website, a public bot or a log. Anyone with it can read the user data your server receives.
The app ID is part of every value. Webhooks carry it in app.id; for integrations it is in GET /integration/me → app.id. A value opened with another app’s ID fails.
Match users by id, never by name or email: readable fields are null in every response.
Audit change values use the field name as context: change_field(change["field"]) in the code above.
Discord webhooks show a name only if your template uses {{appUserName}}. Dashboard actions send the name for that one message; background events show a short ID unless the webhook has Send user names on (then Vaultix can read the names of that app while it is on).
Note checks (POST /integration/notes/exists) take the plain note as before; Vaultix matches it through a keyed index and stores nothing readable.
Turning it on can’t be undone, and while the existing data is sealed, older rows may still arrive readable. Code that handles both is safest.
A failed open (authentication error) means a wrong key, a wrong app ID or a wrong field name.

The endpoints are described in Integration endpoints and Website integration. How the encryption works: End-to-end encryption.

Vaultix · Features · Pricing · Documentation · Changelog · llms.txt