Circuits, methods, and apparatus that provide for protection of configuration bitstreams from theft. One exemplary embodiment receives a scrambled configuration bitstream with an integrated circuit. The scrambled configuration bitstream is descrambled using a plurality of multiplexers under control of a security key. A configuration bitstream is received in portions. One specific embodiment uses a key stored in memory to control a bank of multiplexers that descramble each of the received portions of the configuration bitstream. Other embodiments store longer keys, and use portions of the keys to descramble one or more portions of their respective configuration bitstreams. The outputs of the multiplexers are then stored in configuration memory cells.