A vault holds the mapping between tokens such as [PAN_1] and the values
they stand for. It starts empty and grows as tokenise() meets new
identifiers; the same identifier always gets the same token. The vault
lives in memory only, and printing it masks the values.
Arguments
- key
A token key: at least 64 hex digits (32 bytes), or a raw vector. Make one with
cg_new_token_key().- keyed
Use keyed tokens with the key from
CREDGATE_TOKEN_KEY.
Value
An object of class cg_vault. It is modified in place by
tokenise(), so it does not need to be reassigned.
Details
With a token key, tokens are keyed ([PAN_4qzm7k2x9tbc3]): the same
identifier gets the same token in every vault with that key - across
sessions, datasets, R and Python, and parallel workers, whose vaults can be
combined with vault_merge(). Without a key, tokens are numbered
([PAN_1]) and belong to this vault only. Keyed tokens need the openssl
package.
Whoever holds the key can confirm a guessed value by computing its token, so keep the key like a password: from a key store or the environment variable, never in code or project files.
Examples
vault <- cg_vault()
tokenise("PAN ABCPE1234F", vault)
#> [1] "PAN [PAN_1]"
vault
#> Vault with 1 token (values masked; use `print(x, reveal = TRUE)` to see them):
#> token value
#> [PAN_1] XXXXXX234F
key <- cg_new_token_key()
a <- cg_vault(key)
b <- cg_vault(key)
tokenise("PAN ABCPE1234F", a) == tokenise("pan abcpe1234f", b)
#> [1] FALSE