Skip to content

Clarify TLS encryption applies to both API key and mTLS auth #4162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brianmacdonald-temporal merged 2 commits into from
Jan 29, 2026
Merged

Clarify TLS encryption applies to both API key and mTLS auth #4162

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b60273e
Clarify TLS encryption applies to both API key and mTLS auth
bechols Jan 29, 2026
d5ce4b9
Merge branch 'main' into docs/clarify-api-key-tls-encryption
brianmacdonald-temporal Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 17 additions & 8 deletions docs/evaluate/temporal-cloud/security.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ By deploying a [Codec Server](/production-deployment/data-encryption) you can se
The base unit of isolation in a Temporal environment is a [Namespace](/namespaces).
Each Temporal Cloud account can have multiple Namespaces.
A Namespace (regardless of account) cannot interact with other Namespaces.
Each Namespace is available through a secure gRPC (mTLS) endpoint and an HTTPS (TLS) endpoint.
Each Namespace is available through a secure gRPC endpoint and an HTTPS (TLS) endpoint.
Temporal Cloud is a multi-tenant service.
Namespaces in the same environment are logically segregated.
Namespaces do not share data processing or data storage across regional boundaries.
Expand All @@ -79,18 +79,27 @@ See [Nexus Security](/nexus/security) for more information.

### Encryption

Communication into and out of Namespaces is over TLS.
All communication within our production environments is over TLS 1.3.
Data is stored in two separate locations: an Elasticsearch instance (used when filtering Workflows in SDK clients, the [CLI](/cloud/tcld), or the Web UI) and the core Temporal Cloud persistence layer.
Both are encrypted at rest with AES-256-GCM.
:::tip TLS vs mTLS

**TLS** (Transport Layer Security) encrypts data in transit. **mTLS** (mutual TLS) is an authentication method where both client and server present certificates to verify identity. All Temporal Cloud connections use TLS encryption. When you choose "mTLS authentication," you're choosing how to prove your identity, not whether your connection is encrypted.

:::

For more information, see [Requirements for CA certificates in Temporal Cloud](/cloud/certificates#certificate-requirements).
**In transit**: All connections to Temporal Cloud use TLS 1.3 encryption, regardless of your authentication method ([API keys](/cloud/api-keys) or [mTLS certificates](/cloud/certificates)).

**At rest**: Data is stored in two locations: an Elasticsearch instance (used when filtering Workflows in SDK clients, the [CLI](/cloud/tcld), or the Web UI) and the core Temporal Cloud persistence layer.
Both are encrypted at rest with AES-256-GCM.

### Identity

Authentication to gRPC endpoints is provided by mTLS per Namespace.
Authentication to Temporal Cloud gRPC endpoints supports two methods:

- **[API keys](/cloud/api-keys)**: Identity-based authentication using bearer tokens. Recommended for most use cases.
- **[mTLS certificates](/cloud/certificates)**: Mutual TLS authentication using client certificates issued by your CA.

Both methods provide secure, encrypted connections to Temporal Cloud. Choose based on your organization's security requirements and key management preferences.

For more information, see [How to manage SAML authentication with Temporal Cloud](/cloud/saml).
For user authentication to the Temporal Cloud UI, see [How to manage SAML authentication with Temporal Cloud](/cloud/saml).

### Access

Expand Down