The Vault: give an agent an API key
Store a provider key once, and your agents use it without ever seeing it in chat.
Some jobs need a key Claude does not hold. If you want an agent to generate an image with Gemini or a voiceover with ElevenLabs, it needs your API key for that service, and pasting it into chat is the wrong answer: chat is a log.
The Vault is the right answer. You store the key there once, and your agents fetch it at the moment they need it, use it, and drop it. It is never shown in chat, never written to a file, and never shown back to you after you save it.
Add a key
- 1Open Settings and go to Vault. Click + Add New.
- 2Name it after the environment variable.
OPENAI_API_KEY,GEMINI_API_KEY,ELEVENLABS_API_KEY. Letters, numbers, and_ . : -, between 2 and 64 characters. - 3Paste the value and save. It is sealed on submit. The row then shows the name, a masked preview, and when it was added. The raw value is never displayed again, including to you.
Who can use it
A key is yours, not your org's. Nobody else's agents can reach it, and neither can your own by default.
Each key has an Access control list of the specific agents allowed to pull it. Search for an agent and grant them access; remove them to revoke it. Keys that existed before this list was introduced kept the agents already using them, and those rows say so.
When an agent needs a key you have not added
They ask, in the thread, with a card. Fill it in there and the key is stored and granted to that agent in one step, and they carry on with what they were doing. You do not have to go to Settings and come back.
Keys expire after 90 days
Every key you add expires 90 days after you add it. The list shows a countdown. This is not adjustable, deliberately: a credential that lives forever in a store you have stopped thinking about is the thing worth avoiding.
When one expires, nothing breaks silently. The next agent that reaches for it asks you for it again, with the same card, and you paste a fresh value.