Credential Vault

Store API keys and tokens once in the Edesy credential vault and reference them in custom functions with {{vault.name}} placeholders, so secrets never live in a function definition.

2 min readUpdated

The credential vault stores API keys and tokens for your workspace, encrypted at rest. Custom HTTP functions reference a credential with a placeholder such as {{vault.shopify_token}}, and the secret is filled in only at the moment the request is sent. The secret never appears in the function definition, the prompt or the LLM's context.

At a glance#

Item Value
Scope One vault per workspace
Storage Encrypted at rest
Reference syntax {{vault.NAME}} or {{vault.NAME.FIELD}}
Allowed characters in NAME and FIELD Letters, digits and underscores; NAME starts with a letter or underscore
Where it resolves URL, headers and body of a custom HTTP function
Who can manage it Owners and admins create, edit and delete; members and viewers can view
Usage tracking Last-used time per credential

Provider presets#

Preset Fields
Shopify Store name, access token
Stripe API key
Zendesk Subdomain, email, API token
HubSpot API key
SendGrid API key
Twilio Account SID, auth token
Google Calendar Connected through Google sign-in (OAuth), no fields to type
Custom Any fields you define

Add a credential#

  1. Open the agent's Tools tab and expand Credentials, or open the vault from settings.
  2. Click Add credential and pick a preset, or Custom.
  3. Fill in the fields and save.
  4. Copy the reference (for example {{vault.shopify_store}}) and paste it into your function's URL, headers or body.

Use it in a function#

{
  "name": "lookup_order",
  "httpMethod": "GET",
  "httpUrl": "https://{{vault.shop.store}}.myshopify.com/admin/api/2024-01/orders/{{order_id}}.json",
  "httpHeaders": {
    "X-Shopify-Access-Token": "{{vault.shop.access_token}}"
  }
}

Through the API, bind placeholders to vault credentials with credentialRefs:

{
  "httpHeaders": { "Authorization": "Bearer {{vault.ORDER_API_TOKEN}}" },
  "credentialRefs": [
    { "placeholder": "ORDER_API_TOKEN", "vaultSlug": "acme_orders" }
  ]
}

When a credential has several fields and you leave out .FIELD, the first present field from api_key, apiKey, token, access_token, secret, key, password is used.

Safety rules#

  • A value the LLM or caller supplies is never expanded as a vault reference. If a caller says "{{vault.x}}", it stays as text.
  • If a referenced credential is missing or inactive, the function fails closed instead of sending the request without it. The dashboard flags the broken mapping on the function.
  • Rotate a key by editing the credential. Every function that references it picks up the new value on its next call.

FAQs#

Can the agent read my API key? No. The key is inserted into the outgoing HTTP request only. The LLM sees the function's name, description, parameters and the response you choose to return.

Can I use one credential in many functions? Yes. That is the point of the vault: update it once and every function uses the new value.

Are vault credentials the same as BYOK provider keys? No. BYOK keys are for AI and speech providers (OpenAI, Deepgram and others). See BYOK.

Was this page helpful?