MultiAgent holds the sensitive data of your whole infrastructure: servers’ SSH keys, agent passwords, registry tokens and API keys. This page explains how all of it is protected, how backups are set up, and how licensing works.
Secret encryption
Every secret is encrypted at rest with AES-256-GCM symmetric encryption. The 32-byte key lives in /data/keys/management-secret.key — inside the MultiAgent volume, outside the database. What is protected:
- servers’ SSH passwords and private keys (including proxy jump credentials);
- Postgres and Forgejo passwords on servers;
- image registry tokens (Registry Auth);
- agent managers’ passwords and the secret variables of models and tools;
- API keys and server service passwords (Postgres, Forgejo, central login, backup).
User sign-ins are checked with JWT tokens valid for 90 days, signed by a separate key from /data/keys. Every API action requires a key check; only the login page is anonymous, and the machine interface /api/agent/* opens with its own X-API-Key.
Agent API — the machine interface
The /api/agent/* interface is meant for automatic calls — from agents and external systems. Every request is checked against the X-API-Key header: the MULTIAGENT_API_KEY environment variable stores only the key’s fingerprint (a SHA-256 hash), and the key itself is set once at install. Without the variable, the interface answers 503 and does not work at all.
Security details: GET /api/agent returns a catalog of every operation with descriptions; secrets can only be written — they are never given back, only “has a value” hints; there is no remote code execution — only pre-defined operations; long operations follow the “start it, then poll” pattern at operations/{id}. Details — Agent API.
Backups
On every server MultiAgent runs an rsyncd container — a small backup service — with seven read-only modules: the docker, home, data, projects and tools folders, plus two dump folders. Your backup machines pull the data by rsync on a schedule — a typical nightly task:
# nightly backup of all server data
rsync -avz rsync://backup@server-host:873/data/ /backups/server-host/data/
rsync -avz rsync://backup@server-host:873/projects/ /backups/server-host/projects/MultiAgent itself is backed up together with its /data volume: the database, the encryption keys and the license live there. More about the data layout — in the installation guide.
Agent licenses
The “Licenses” section is the central store for Xedant Agent family license keys. A key is verified when added, encrypted at rest, and never returned by the API — the interface shows only the parsed metadata (type, owner, term, covered products) and never the key itself. The licenses page and the details dialog show a “Products” field: the list of products from the key, or “Universal” for a universal key. A correctly signed key that does not cover the product you need returns a coverage error instead of a term — the status tells you exactly what is wrong. One key can be assigned to any number of agents and lands automatically in their AGENT_LICENSE variable at deployment. A license assigned to at least one agent cannot be deleted until you detach it.
MultiAgent licensing
MultiAgent itself ships with a 30-day trial baked into the image. The license is a self-contained signed string: you load it through the AGENT_LICENSE variable (the same one every product in the family reads) or as an activation file in the data folder, and it is verified offline against a built-in key. A universal key (no product list) covers every product; an invalid license blocks only creating new things and sending messages. License types and prices — on the Licensing page.