> ## Documentation Index
> Fetch the complete documentation index at: https://docs.navigara.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Encrypted Git Tokens

> Encrypt Git tokens on your collector so Navigara stores them without ever being able to read them.

## Overview

Running the [on-prem collector](/deployment/on-prem-collector) in hybrid mode, you can store a Git personal access token (PAT) that **Navigara can never read**. You encrypt the token on your own collector host; Navigara only ever stores and forwards the ciphertext. The collector holds the private key and decrypts each token in memory, only when it authenticates to the Git host — **the plaintext token and the private key never leave your network.**

If a blob can't be decrypted (wrong key, tampering, or a paste error), the collector drops it and fails the task — it is never forwarded to the Git host.

<Note>
  For the step-by-step setup (create the PAT, mount the key, paste the blob), see [On-Prem Collector → Provider Tokens, End-to-End Encrypted](/deployment/on-prem-collector#option-2-provider-tokens-end-to-end-encrypted-all-providers). This page is the CLI and rotation reference.
</Note>

## Collector CLI

The collector binary handles key generation and encryption — you already have it on the collector host. Tokens are read from **stdin**.

```bash theme={null}
# Generate an X25519 keypair → private.pem (0600) + public.pem, and print the fingerprint.
# Refuses to overwrite an existing private.pem.
collector keygen --out /etc/navigara/keys

# Encrypt a token → prints the navigara-enc-v1: blob to paste into the dashboard.
echo -n 'ghp_yourtoken' | collector encrypt-token --public-key /etc/navigara/keys/public.pem

# Verify a blob decrypts back to the original token.
echo 'navigara-enc-v1:...' | collector decrypt-token --private-key /etc/navigara/keys/private.pem
```

Keep `private.pem` on the collector host — it is never shared. Then point the running collector at it for decryption:

| Env var                      | Description                                                            |
| ---------------------------- | ---------------------------------------------------------------------- |
| `COLLECTOR_PRIVATE_KEY_PATH` | Path to a PEM private key. Comma-separate multiple files for rotation. |
| `COLLECTOR_PRIVATE_KEY_PEM`  | Inline PEM private key(s), as an alternative to the path.              |

## Key rotation

Both env vars accept **multiple keys**, and the collector picks the right one per blob. So you can roll a new key without downtime: generate it, add it to `COLLECTOR_PRIVATE_KEY_PATH` alongside the old one, re-encrypt and re-paste tokens at your own pace, then drop the old key once nothing uses it.