> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neobank.proofof.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Perflo credential bridge and production grant gate

> The Perflo credential bridge is temporary and non-production; production requires a scoped partner adapter.

# ADR 0004: Restrict the Perflo credential bridge to non-production environments

This record defines the temporary bridge and its removal gate.

## Context

The current device refresh token grants more authority than the neobank needs. Encryption and route filtering reduce exposure but do not create upstream least privilege.

## Decision

Permit fake and broad device-link adapters only outside production. Encrypt pilot refresh tokens with Vault Transit, restrict upstream routes, serialize refresh, audit use, and erase credentials on disconnect.

Production startup requires a partner adapter with audience-bound scopes and resource constraints. It refuses fake and pilot modes.

## Consequences

Developers can build against current contracts without representing the bridge as production-safe. Production remains blocked on [PFR-001 through PFR-004 and PFR-007](get-started/production-readiness).

## Rejected alternatives

* **Encrypted broad token in production**: an authorized backend compromise could still exercise broad authority.
* **Browser-held Perflo token**: cross-site scripting would expose the upstream credential.