Site Key (MAUTH_SITE_KEY) Guide

MAUTH_SITE_KEY is the secret key used to authenticate requests made to Mindful Auth’s APIs. It is essential for validating your portal sessions and must be added as an environment variable in your deployment platform (see Cloudflare Workers deployment). It is also required for performing administrative actions such as locking or unlocking member accounts.

Encryption details

MAUTH_SITE_KEY uses AES-GCM-256 encryption with per-tenant key derivation via HKDF-SHA256. Master key combined with unique tenantSalt per tenant. Same encryption pattern used for 2FA secrets, backend credentials, and Turnstile secrets. Encrypted form stored in Cloudflare KV, decrypted on-demand for validation.

You can find your MAUTH_SITE_KEY in the Mindful Auth admin portal under the “MAuth Site Key” section for your hostnames. Note that the key is different for every hostname you onboard (unless they share the same app ID).