Skip to content
Indigo HQ Docs

HQ Pro — Vault, Teams & Identity

Part of the split HQ ecosystem. HQ Pro is the cloud backend that the hq-console admin UI and the hq-deploy data plane both build on.

HQ Pro is the team and identity backend for HQ. It provisions the shared identity, stores secrets and files in an encrypted vault, and runs the team platform that turns a solo HQ into a multi-member organization. It is an SST (v4) application on AWS.

What it provides

  • Vault — capability-based access. Encrypted S3 storage with a deny-all default, KMS encryption, and STS-scoped capabilities. Access is granted as narrow, time-bound capabilities rather than broad credentials. This is what the hq-secrets and hq-share CLI capabilities operate against.
  • Shared Cognito identity. One Cognito user pool that every cloud app trusts — hq-console signs in against it (OIDC) and hq-deploy verifies JWTs minted by it. Neither runs its own user store.
  • Companies and memberships. Companies, members, and roles (owner, admin, member, guest).
  • Sign-in. Google and Microsoft accounts, federated through the shared Cognito pool. There is no email-and-password sign-up.
  • Install. New users install the HQ desktop app (macOS and Windows) from hqforwork.com/install.

In this section

  • hq-secrets — schema-driven secret access against the vault
  • hq-share — single-use vault share-session links