Navigation
Vault access. Public access is not open. This product is separate from initial Identity and Apparatus access.
Screenshots use fictional demonstration accounts. Your data and available actions may differ. Reviewed October 16, 2026.
Concepts
Understand a credential record
Identify the record
The name is a human label. The key is the path clients use, composed from the folder path and credential slug. The internal record ID is a separate identifier, available in technical details. Moving a folder changes descendant keys, so update clients that refer to those paths.
Separate metadata from the value
The name, description, tags, type and permitted connection details support browsing. They are not secret storage. Passwords, private keys, tokens and other confidential type fields belong in the encrypted envelope. The server accepts only allowed public metadata fields from creation requests.
A typed envelope contains a version, type and the fields needed by that type. A legacy record may contain a raw string. The type-specific detail card shows public connection context before the copy action. It does not decrypt the record merely to render the page.
Use Details, Access, Activity and Manage for the record’s different tasks. There is no general standalone metadata editor in the current console. Rotate to replace a credential intentionally, and archive when it should leave active use.
Screen reference
