> For the complete documentation index, see [llms.txt](https://docs.elsaworkflows.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elsaworkflows.io/guides/security.md).

# Security & Hardening

This section covers the security controls around an Elsa deployment: how traffic reaches it, how workflow callbacks are protected, how sensitive values are handled, and how to operate the deployment safely in production.

Authentication and authorization answer a different question: **who may call Elsa and what may they do?** For Elsa Identity, API keys, OpenID Connect, permissions, and External Authentication, start with [Authentication & Authorization](/guides/authentication.md).

## Security Guides

| Guide                                                                | Use it when you need to...                                                                                            |
| -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| [HTTP Endpoint Security](/guides/security/http-endpoint-security.md) | Protect workflow routes created by the `HttpEndpoint` activity, including public endpoints and ASP.NET Core policies. |
| [Bookmark Resume Tokens](/guides/security/bookmark-resume-tokens.md) | Send or receive tokenized callback URLs that resume waiting workflows.                                                |
| [Production Hardening](/guides/security/production-hardening.md)     | Configure browser boundaries, ingress, TLS, Studio deployment, monitoring, and operational checks.                    |
| [Secrets Management](/guides/security/secrets-management.md)         | Store and resolve named values from workflows and Elsa modules.                                                       |

## Scope and Boundaries

Security controls complement authentication; they do not replace it.

* Secure **workflow ingress** separately from Elsa API access. A public `HttpEndpoint` does not make the Elsa API public, and Elsa API permissions do not automatically protect a workflow route. See [HTTP endpoint security](/guides/security/http-endpoint-security.md).
* Treat a bookmark resume URL as a bearer capability. Give it an appropriate lifetime, do not log its token, and apply controls appropriate to the callback's risk. See [Bookmark resume tokens](/guides/security/bookmark-resume-tokens.md).
* Keep host and infrastructure secrets outside source control. For values that workflows must resolve, use the [Secrets management](/guides/security/secrets-management.md) module and protect its encryption key.
* Apply network, transport, browser, and deployment controls before exposing Elsa or Studio to untrusted networks. See [Production hardening](/guides/security/production-hardening.md).

## Related documentation

* [Authentication & Authorization](/guides/authentication.md)
* [Permissions reference](/guides/authentication/permissions.md)
* [Direct OpenID Connect](/guides/authentication/direct-openid-connect.md)
* [External Authentication](/guides/authentication/external-authentication.md)
* [Clustering](/guides/clustering.md)
* [Monitoring & Observability](/operate/monitoring-observability.md)