Setup: self-hosted Cloudflare host, Cloudflare Access auth. An org-owned OAuth connection (owner: "org") whose OAuth consent flow completes in a human user's browser session.
Observed: the encrypted token rows are written to plugin_storage under that user's partition (owner='user', subject=<user uuid>, keys like oauth:user:<integration>:<connection>...), while the connection row itself says org. Every other principal (e.g. an Access service token) then fails the connection with oauth_connection_missing. The UI still shows the connection healthy, because the creating user's health probe can read the token rows.
Workaround that confirmed the diagnosis: a one-row D1 update moving the vault rows to owner='org', subject='' — encryption is global-key rather than principal-bound, so the rows decrypt fine afterwards and the connection works for all org principals.
Expected: token rows for an org-owned connection should be stored under the org partition regardless of which browser session completed the consent.
Happy to provide more detail from the reproduction if useful.
Setup: self-hosted Cloudflare host, Cloudflare Access auth. An org-owned OAuth connection (
owner: "org") whose OAuth consent flow completes in a human user's browser session.Observed: the encrypted token rows are written to
plugin_storageunder that user's partition (owner='user', subject=<user uuid>, keys likeoauth:user:<integration>:<connection>...), while the connection row itself saysorg. Every other principal (e.g. an Access service token) then fails the connection withoauth_connection_missing. The UI still shows the connection healthy, because the creating user's health probe can read the token rows.Workaround that confirmed the diagnosis: a one-row D1 update moving the vault rows to
owner='org', subject=''— encryption is global-key rather than principal-bound, so the rows decrypt fine afterwards and the connection works for all org principals.Expected: token rows for an org-owned connection should be stored under the org partition regardless of which browser session completed the consent.
Happy to provide more detail from the reproduction if useful.