Zero-knowledge: secrets are decrypted in your browser. Cloudflare never sees plaintext.
Enter the tenant passphrase to load the private key into this browser session.
First-time setup (admin): create the tenant key →
Generates an RSA keypair in your browser. The private key is wrapped with this passphrase and stored encrypted — the server cannot decrypt it. If the passphrase is lost it cannot be recovered (set up Shamir break-glass per SECURITY.md).