# Secrets

> **Status: work in progress.** The vault surface is settling; these pages
> track it.

The Secrets vault is where API keys, database credentials, environment
variables, certificates, and other sensitive data live — in one place,
instead of scattered across dotfiles and chat history.

## What it does

- **Personal and team vaults** — a private vault of your own, plus shared
  vaults for the orgs you work in
- **Typed items** — every secret carries a category: API key, database,
  auth, environment, certificate, and more
- **MCP access** — agents and assistants read what they need at runtime,
  no pasting keys into prompts
- **An activity log** — every use of a secret is recorded, and you can
  inspect it

## Where encryption stands

Honesty first: secrets are stored **encrypted at rest on the server** —
server-side encryption, not end-to-end. The server can read secret values
when a request needs them (routing a chat to the provider your key belongs
to, resolving a `vault://` reference for an agent) and never shows them to
models. New and upgraded items are encrypted individually, each under its
own versioned key. A dedicated crypto page lands when the migration story
settles; until then this note is the whole truth.

## Sections

- [Vault management](/docs/secrets-vaults) — personal and team vaults, and
  what lives in them.
- [Environment variables](/docs/secrets-env-variables) — configuration
  values in the vault.
- [MCP integration](/docs/secrets-mcp-integration) — how agents and
  assistants get access.
- [API tokens](/docs/secrets-api-tokens) — programmatic access, and where
  it stands today.
- [Team sharing](/docs/secrets-team-sharing) — shared vaults, roles, and
  the audit trail.