Architecture
This section is for evaluators and engineers who need to know what Katta does internally. The first three pages follow the three runtime flows: how a user gets their keys, what happens when someone creates a vault, and how the client reaches S3. The rest covers the security model, the scoped tokens behind storage access, and the Keycloak realm.
These pages may lag behind the latest implementation in some details. When in doubt, the tests in the keycloak module of Katta Server are authoritative.
User Keys
How Katta Desktop obtains the user's key pair — first login, a new device, and account recovery.
Vault Creation
What happens when a user creates a vault, with static or scoped credentials.
Storage Access
How the client authenticates, obtains storage credentials, unlocks a vault, and syncs data end-to-end encrypted.
Security
The cryptographic keys, what Katta Server stores, how access is granted, and the threat model.
Tokens
Scoped tokens for S3 storage access — the STS flow, the AWS and MinIO IAM data models, and the inline policies for bucket creation.
Keycloak
The Keycloak realm behind Katta — data model, membership sync, token exchange, and the diff to the upstream realm.