Encrypt Temporal workflow payloads end to end with a custom Payload Codec and run a Codec Server for the Web UI and CLI

Documented steps

1. Understand the pipeline: the Payload Converter serializes objects to bytes first, then the Payload Codec applies a bytes-to-bytes transform such as encryption or compression as part of the overall Data Converter. On read, decode runs before deserialization.
2. Implement a custom Payload Codec in your SDK language that encrypts on `encode` and decrypts on `decode`. Temporal publishes reference AES-256-GCM encryption codec samples for Go, Java, Python, and TypeScript to start from.
3. Wire the codec into a custom Data Converter and configure it on both your Workers and every Client that starts or queries workflows, so workflow, activity, and child-workflow inputs and outputs, signal inputs, memos, query data, local activity results, and side effects are all encrypted before leaving your process.
4. Keep encryption keys only on Workers and Clients you control. The Temporal Service, self-hosted or Cloud, only ever stores the encrypted bytes.
5. Build a Codec Server: an HTTPS server implementing the Temporal Codec Server Protocol with `/encode` (plaintext Payload JSON in, encoded Payload JSON out) and `/decode` (encoded in, plaintext out), reusing the same codec logic as your workers. Add `/download` if you need to fetch and decode externally stored large payloads.
6. Enable CORS. For the Temporal Cloud Web UI the data-encryption docs specify returning `Access-Control-Allow-Origin: https://cloud.temporal.io`, `Access-Control-Allow-Methods: POST, GET, OPTIONS`, and `Access-Control-Allow-Headers: X-Namespace, Content-Type`.
7. Point the Web UI at the Codec Server: Namespaces > select namespace > Edit > enter the Codec Server endpoint URL, optionally toggling pass-access-token and cross-origin credentials.
8. Point the CLI at it globally with `temporal env set --codec-endpoint "http://localhost:8888"`, or per command: `temporal --codec-endpoint "http://localhost:8888" --namespace "yourNamespace" workflow show --workflow-id "yourWorkflow"`. Pass `--codec-auth '<header>'` when the server requires authentication.
9. In production require HTTPS (auth headers are supported only over HTTPS), restrict network access, and put OAuth/JWT auth in front of the endpoints. With Temporal Cloud's pass-access-token option your server can validate the JWT against https://login.tmprl.cloud/.well-known/jwks.json.
10. Reference docs: https://docs.temporal.io/production-deployment/data-encryption | https://docs.temporal.io/codec-server | https://docs.temporal.io/payload-codec