# End-to-end encryption for Vercel Workflow By Steven Van · 2026-03-17 Vercel Workflow now encrypts inputs, arguments, and payloads end-to-end by default, with dashboard and CLI decryption gated by env-variable permissions. [Vercel]() Workflow now encrypts inputs, step arguments, return values, hook payloads, and stream data end-to-end, with no code changes required. Data is encrypted before it reaches the event log, so the log only ever stores ciphertext, making it safer to pass API keys, tokens, or user credentials between workflow steps. Each workflow run derives its own key via HKDF-SHA256, and data is encrypted with AES-256-GCM. Encrypted fields show up as locked placeholders in the dashboard until decrypted. - In the web dashboard, clicking Decrypt in the run detail panel decrypts data in the browser via the Web Crypto API, so the observability server never sees plaintext. - From the CLI, adding **--decrypt** to the inspect command does the same. Decryption follows the same permissions model as project environment variables, so a user without permission to view env vars can't access workflow data either. Every decryption request is recorded in Vercel's audit log. Custom World implementations can opt into the [encryption]() by supplying their own getEncryptionKeyForRun() method, which the runtime picks up automatically. [![]()]() ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() Sources [Original source]() [Read End-to-end encryption for Vercel Workflow on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-end-to-end-encryption-for-vercel-workflow