App registrations
Entra app registrations EstimateIQ uses to read carrier correspondence via Microsoft Graph. Certificate auth is preferred (nothing to rotate); client secrets are stored AES-256-GCM encrypted — the UI only ever shows the last four characters.
Registrations
2 configured · secrets never leave the server| Name | Auth | Client ID | Credential | Scopes | Status | |
|---|---|---|---|---|---|---|
| GRS Mail Reader (multi-tenant, cert) tenant 8f1c…-grs · multi-tenant | certificate | cert 6702A9E447FA… | Mail.ReadMail.ReadBasic.AllUser.Read.All | active | ||
| GRS Webhook Relay (secret) tenant 8f1c…-grs | secret | ••••••••teMe · exp Oct 29 | Mail.Send | active |
Add registration
How secrets are protected
● encryption at rest
Client secrets are encrypted with AES-256-GCM via Web Crypto before they touch the database. The encryption key comes from REVSRC_SECRET_KEY locally, or a wrangler secret in production — never from the repo. The API returns only hasSecret and the last four characters; the ciphertext is never serialized to the client.
crypto: AES-256-GCM · key: REVSRC_SECRET_KEY / wrangler secret
● multi-tenant pattern
One registration in the Lockstep tenant; each GRS-managed carrier mailbox tenant consents once, creating a service principal there. Certificate auth means a single credential works across every consented tenant with nothing to rotate.
read-only Graph scopes · cert thumbprint only