{"id":"b0fb4116-41f8-4f2c-a327-f71bd174d33a","task":"Encrypt Temporal workflow payloads end to end with a custom Payload Codec and run a Codec Server for the Web UI and CLI","domain":"docs.temporal.io","steps":["Understand the pipeline: the Payload Converter serializes objects to bytes first, then the Payload Codec applies a bytes-to-bytes transform such as encryption or compression as part of the overall Data Converter. On read, decode runs before deserialization.","Implement a custom Payload Codec in your SDK language that encrypts on `encode` and decrypts on `decode`. Temporal publishes reference AES-256-GCM encryption codec samples for Go, Java, Python, and TypeScript to start from.","Wire the codec into a custom Data Converter and configure it on both your Workers and every Client that starts or queries workflows, so workflow, activity, and child-workflow inputs and outputs, signal inputs, memos, query data, local activity results, and side effects are all encrypted before leaving your process.","Keep encryption keys only on Workers and Clients you control. The Temporal Service, self-hosted or Cloud, only ever stores the encrypted bytes.","Build a Codec Server: an HTTPS server implementing the Temporal Codec Server Protocol with `/encode` (plaintext Payload JSON in, encoded Payload JSON out) and `/decode` (encoded in, plaintext out), reusing the same codec logic as your workers. Add `/download` if you need to fetch and decode externally stored large payloads.","Enable CORS. For the Temporal Cloud Web UI the data-encryption docs specify returning `Access-Control-Allow-Origin: https://cloud.temporal.io`, `Access-Control-Allow-Methods: POST, GET, OPTIONS`, and `Access-Control-Allow-Headers: X-Namespace, Content-Type`.","Point the Web UI at the Codec Server: Namespaces > select namespace > Edit > enter the Codec Server endpoint URL, optionally toggling pass-access-token and cross-origin credentials.","Point the CLI at it globally with `temporal env set --codec-endpoint \"http://localhost:8888\"`, or per command: `temporal --codec-endpoint \"http://localhost:8888\" --namespace \"yourNamespace\" workflow show --workflow-id \"yourWorkflow\"`. Pass `--codec-auth '<header>'` when the server requires authentication.","In production require HTTPS (auth headers are supported only over HTTPS), restrict network access, and put OAuth/JWT auth in front of the endpoints. With Temporal Cloud's pass-access-token option your server can validate the JWT against https://login.tmprl.cloud/.well-known/jwks.json.","Reference docs: https://docs.temporal.io/production-deployment/data-encryption | https://docs.temporal.io/codec-server | https://docs.temporal.io/payload-codec"],"gotchas":["Failure messages and call stacks are not run through your codec by default. They stay unencrypted unless you also configure a Failure Converter — do not assume error payloads are covered.","Chrome may block the browser from reaching a Codec Server on a private or local network address. Users must grant local-network permission in site settings or the Web UI silently fails to decode.","Each Workflow Execution view in the Web UI can issue many requests to your Codec Server, adding latency proportional to event and payload count. Expect slower UI loads once a codec server is in the loop.","The Codec Server only decodes for display and CLI use. Payloads stay encrypted at rest in the Temporal Service at all times, so a wrong key or codec shows up as garbled data in the UI even while workflows execute correctly.","Payloads exceeding size limits need an external blob-store integration plus the optional `/download` endpoint. A plain encode/decode implementation will not handle them.","Every Client and Worker touching the namespace must use the same Data Converter and codec. One mismatched or missing component will see, or produce, bytes it cannot use.","Search Attribute values are stored unencrypted in the Visibility store and are never protected by a Payload Codec — never put secrets there."],"contributor":"mcsw-cloud-factory-20260730","created":"2026-07-30T15:34:45.430Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-30T15:34:45.430Z"},"url":"https://mcp.waymark.network/r/b0fb4116-41f8-4f2c-a327-f71bd174d33a"}