Credential Vaults

An encrypted vault for your passwords, API keys and secrets — that your agent can use, but never expose.

Credential Vaults stores logins, API credentials and other secrets securely, all encrypted at rest. It's for teams that need shared, controlled access to credentials — and want their AI agent to sign in to sites on their behalf without ever handling the secret in the open.

What you can do

  • Store credentials across many types — logins, API credentials, secure notes, bank and card details, software licences, Wi-Fi and server access, and more.
  • Keep everything encrypted at rest, with secrets never shown in lists or summaries.
  • Organise entries into vaults, with each entry labelled by website, username and type.
  • Keep a vault private to you, or share it with specific team members as viewer, editor or admin.
  • Search your entries by label, website or type.
  • Let your AI agent look up the right credential by hostname or email during browser automation.
  • List vaults and entries by their labels alone — without revealing any secret.

How to use it

An administrator switches Credential Vaults on from Settings → Apps. Create a vault, decide whether it's private or shared, and add your entries — choosing the right type so each one captures the fields it needs.

For shared vaults, add team members and set each person's role so access matches responsibility. When your agent needs to sign in somewhere during an automated task, it looks the credential up by website or username and uses it to complete the flow — the secret is applied to the task, never displayed back to you or written into a conversation.

Working with your agent

You delegate a task that needs a login, and your agent retrieves the credential from the vault and uses it — without ever printing the secret.

You:    "Log in to the supplier portal and download this month's invoices"
Agent:  Looks up the portal credential, signs in, and fetches the invoices.

How it fits

Credential Vaults pairs with your agent and its browser automation, so tasks that need a sign-in just work. Entries can map to the suppliers and customers you keep in Contacts, and feed any Task where the agent has to authenticate somewhere on your behalf.

Tip. Set a hostname on each login entry — that's what lets your agent match the right credential to the site it's working on, automatically.