Voxta Security
Encrypting your content, deciding who may sign in and what apps and tools may do, and exposing the server safely.
Voxta runs on your own machine and holds unusually personal content — conversations, character sheets, generated images. Several separate things protect it, and they answer different questions.
Encryption
Sealing your content so a copy of the Data folder is inert.
Accounts & access
Passwords, and which local programs may sign in.
API keys
Scopes: giving each app only what it needs.
Shared accounts
Accounts administrators step into, for bots.
Tool permissions & review
What a character's tools may do without asking, and what is refused anyway.
Network exposure
What changes when the server is reachable from off the machine.
A reasonable setup
For a normal single-user desktop install:
- Set an account password, and turn on encryption in Password mode. Write the recovery code down somewhere that is not this machine.
- Issue an API key for each client you actually use — the VAM plugin, Voxy, your own scripts — with only the scopes it needs.
- Turn off "allow external apps" once those clients work with their keys, so nothing else on the machine can sign in as you.
- Leave the server bound to loopback unless you have a reason not to.
Steps 2 and 3 are in that order on purpose. Turning the flag off first cuts off every local client that had no credential.