Temporal Cloud Proxy (Documentation Index
Fetch the complete documentation index at: https://mintlify.com/temporal-sa/temporal-cloud-proxy/llms.txt
Use this file to discover all available pages before exploring further.
tclp) is a gRPC proxy that sits between your Temporal workers and Temporal Cloud. It centralises cross-cutting concerns — namespace authentication, payload encryption/decryption, and worker identity verification — so individual workers stay simple and your security configuration stays in one place.
Quickstart
Build and run the proxy in minutes with a minimal working configuration.
How It Works
Understand the request flow, workload routing, and component architecture.
Configuration Reference
Full reference for every YAML configuration option the proxy supports.
Deployment
Run the proxy as a binary, Docker container, or alongside your workers.
Key Features
Multi-Workload Routing
A single proxy instance handles multiple Temporal namespaces. Workers select a workload by sending a
workload-id gRPC metadata header.Namespace Authentication
Connect to Temporal Cloud using mTLS certificate pairs or API keys — configured per workload, managed centrally.
Worker Authentication
Validate worker identities with JWT tokens (verified against a JWKS endpoint) or SPIFFE/SPIRE SVIDs.
Payload Encryption
Transparently encrypt and decrypt workflow payloads using AES-GCM with AWS KMS or GCP KMS data keys.
Key Caching
LRU-based caching of cryptographic materials reduces KMS API calls with configurable TTL and usage limits.
Prometheus Metrics
Built-in metrics for request counts, latency, encryption rates, and per-workload statistics, plus a Grafana dashboard.
Quick Overview
Install the proxy
Clone the repository and build the
tclp binary with make build, or pull the Docker image from GitHub Container Registry.Write a config file
Copy
config.sample.yaml and fill in your Temporal Cloud namespace, authentication credentials, and any encryption or worker auth settings.Start the proxy
Run
./tclp --config config.yaml. The proxy binds on port 7233 (gRPC) and 9090 (Prometheus metrics) by default.Temporal Cloud Proxy is open source under the MIT license. Example worker implementations using SPIFFE authentication and JWT authentication are available as companion repositories.