Struct IbctKeyConfig 

pub struct IbctKeyConfig {
    pub key_id: String,
    pub key_hex: String,
}

An IBCT signing key entry in the A2A server configuration.

Multiple entries allow key rotation: keep old keys until all tokens signed with them expire.

Serialize is hand-written and redacts key_hex to "[REDACTED]" (mirroring the Debug impl below); Deserialize is derived and reads the real hex key untouched, since config loading and the --init wizard both need the real value on the way in.

Tradeoff

A future “load config → mutate → save TOML” flow that persists an inline [a2a] ibct_keys[].key_hex would round-trip through this redacting Serialize and write back key_hex = "[REDACTED]", corrupting the key. This is acceptable today: no such flow exists, --migrate-config operates on the TOML text directly (never through Config/Serialize), and the documented direction is vault-resolved keys via A2aServerConfig::ibct_signing_key_vault_ref (which takes precedence over ibct_keys[0]), making inline key_hex a legacy path. If a struct-based config save flow is ever added, this type should graduate to a split config/diagnostic-shape design instead of redacting in place.

Fields

key_id: String

Unique key identifier. Must match the key_id field in issued IBCT tokens.

key_hex: String

Hex-encoded HMAC-SHA256 signing key.

Trait Implementations

impl Clone for IbctKeyConfig

fn clone(&self) -> IbctKeyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IbctKeyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IbctKeyConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for IbctKeyConfig

fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.