# WorkOS Pipes: Where your users' tokens actually live

DevFeed: [WorkOS Pipes: Where your users' tokens actually live](<https://devfeed.tech/articles/workos-pipes-where-your-users-tokens-actually-live-16075.md>)

Original publisher: [Read original article](<https://workos.com/blog/workos-pipes-where-your-users-tokens-actually-live>)

Author: WorkOS

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Encryption](<https://devfeed.tech/topics/encryption.md>), [Security](<https://devfeed.tech/topics/security.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [API](<https://devfeed.tech/topics/api.md>), [migration](<https://devfeed.tech/topics/migration.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [migration](<https://devfeed.tech/tags/migration.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [organization](<https://devfeed.tech/tags/organization.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article explains how WorkOS Pipes stores and protects users' OAuth and other connection credentials. It distinguishes connection metadata from credential values, describes scoped access and AES-256 encryption at rest, covers PKCE support and security posture, and discusses migrating existing tokens and the validation risks of updates.

## Source excerpt

A walk through the Pipes credential vault: envelope encryption, key context, what a compromised key reaches, and how key rotation happens without re-consent.