Temporal Proxy is an open-source, user-operated gRPC proxy that sits between your applications, Workers, and Temporal Cloud or self-hosted Temporal server. Platform teams deploy it in their own infrastructure to manage envelope encryption with user-owned KMS keys (AWS KMS, Azure Key Vault, GCP KMS, and more), upstream credentials (e.g. Temporal Cloud API Keys or mTLS certificates), Namespace routing, and inbound authentication (e.g. an IDP, policy layer, or your own custom services). This model applies security practices platform-wide, without requiring each application team to implement payload encryption or manage Cloud credentials in their own code. It includes a built-in Codec Server for decrypting messages for display in the Web UI and CLI. Deploy Temporal Proxy as a sidecar or shared service using the provided Helm chart or Docker Hub container image.