What Nylon stores

Nylon sits between your application and every social network, so it necessarily holds credentials. This is what it keeps and how.

​

Social account credentials

The tokens a network issues when a user authorizes an account are stored encrypted with AES-256-GCM. Each ciphertext is bound to what it was sealed for and to the organization that owns it, so a stored blob cannot be unsealed as something else or replayed into another organization’s record. Bluesky is a special case worth knowing: Nylon exchanges the app password for a session immediately and never stores the password itself. Disconnecting an account destroys its stored credential. It is cleared in the same transaction that marks the profile disconnected — there is no soft-deleted copy kept for a possible reconnect. That is Nylon’s side. Only the network itself can forget that it once issued a credential, so if you want access fully revoked, also remove Nylon from that account’s connected-apps list. See Disconnect an account.

​

API keys

A key is hashed with SHA-256 before it is stored. Nylon keeps the first 18 and last 4 characters in clear, which is what the masked value on the API page is built from, and nothing else. This is why a key is shown once and cannot be recovered: Nylon does not have it. Lose one and the only option is to revoke and replace it.

​

Webhook signing secrets

Encrypted with the same scheme as social credentials, because unlike an API key a signing secret has to be recoverable — you cannot produce an HMAC signature from a hash. Like API keys, a signing secret is displayed once, on creation and on rotation.

​

Request logs

Every API request is recorded with its method, path, status, duration, and its full request and response body. Before a body is stored, anything that looks like a credential is redacted: any field whose name contains authorization, password, secret, token, api key or credential is replaced with [REDACTED], at every level of a nested object. Everything else is stored as sent — post text, media URLs, profile identifiers. If your post bodies would carry personal data beyond that, know that it is in the log.

​

Webhook payloads

Each delivery stores the payload Nylon sent and the response body your endpoint returned, so you can inspect either from the delivery log. Deleting a webhook endpoint deletes its entire delivery history with it.

​

Your own data

Your name and email, your organization’s name and icon, and your team’s membership. Payments run through Stripe — card details are held by Stripe, not by Nylon.

​

Removing things

For data requests beyond these, email support@nylon.dev.

​

Related