Vault

Vault is GATE's encrypted store for the secrets your bots and tools need: API keys, tokens, passwords, and other sensitive values.

It keeps those values in one scoped place instead of scattering them through workspace files. Listings show names and masked hints, not plaintext. Every time a person reveals a value or a bot reads one, Vault records who accessed what, when, and from where.

Four scopes

A secret belongs to one scope:

• Bot — only that bot.
• User — the person who owns it and bots acting through that user.
• Organization — shared with authorized members and bots in one org.
• System — platform-wide, managed by a master administrator.

Access is resolved server-side from the signed-in user or bot token. Asking for a different scope never widens what the caller is allowed to see.

What you can do

Open Vault in the dashboard to:

• create a named secret and choose its type and scope,
• browse metadata and masked hints without revealing values,
• reveal a value when you genuinely need to inspect it,
• review the whole access audit or one secret's history,
• roll a secret by replacing its value in place, or
• kill a compromised secret so every future read is refused.

Killing is not deletion. Vault preserves the record and its audit history, and the old value can no longer be read. You may then create a fresh active secret with the same name.

Encryption and auditing

Values are encrypted in GATE's database with AES-256-GCM. Every value read goes through one audited decrypt path; if the audit write fails, the plaintext is not returned. Vault never writes a retrieved value to a file on its own.

For how Vault fits alongside delegated OAuth connections and model auth profiles, see Credentials & delegation. Operators can find the storage and authorization details in the Security model.