Authentication & Secrets
Owner: Ivy, Founder, Koda Digital · Effective: 2026-09-03
1. Transport security
All traffic is HTTPS. The backend is served on *.cloudfunctions.net / *.run.app with
Google-managed certificates (TLS 1.2+, automatic renewal). Plaid endpoints use Plaid's
certificates. The Android app does not permit cleartext traffic in release builds.
2. Tokens and credentials in use
| Credential | Purpose | Where it lives | Rotation |
|---|---|---|---|
Plaid client_id / secret |
Backend → Plaid | Google Secret Manager; injected into the function at runtime; never in git or the app | On suspicion of leak, or annually |
| Plaid access tokens (per Item) | Backend → Plaid data | Firestore users/primary/plaid_tokens/{itemId}; readable only by the backend service account |
Revoked via /item/remove on unlink |
| Plaid link tokens | One-time, short-lived, created server-side to open Link | Passed to the app and consumed immediately; expire in ≤4 h per Plaid | n/a |
API_SHARED_KEY |
App → backend | Secret Manager (server); baked into the app bundle (client) | On suspicion of leak; requires app rebuild |
| Google service-account credentials | Backend → Firestore/Secret Manager | Google-managed, short-lived, no user-managed keys | Automatic |
| Operator Google account | Console/CLI access | Password manager + 2SV passkey/security key | Per Google policy |
Bank credentials are never handled by Koda Finance code — they are entered only within Plaid Link's hosted UI.
3. Rules
- No secret may be committed to source control (
.env,.env.local, keystores are gitignored;functions/.envholds only non-secret configuration). - Secrets are accessed by name from Secret Manager at deploy time (
defineSecret), never copied into environment files in production. - Superseded secret versions are destroyed at the next access review.
- Release APKs are signed with a dedicated keystore kept outside the repository.
4. Known limitation and planned improvement
The app-to-backend API key is a shared secret embedded in the app, not hardware attestation. Its blast radius is limited (read access to one user's aggregated data; no Plaid tokens), and it can be rotated in minutes. Planned improvement: Firebase App Check with Play Integrity to bind requests to genuine, unmodified app installs.