# Credential Vault

> Store API keys and tokens once in the Edesy credential vault and reference them in custom functions with {{vault.name}} placeholders, so secrets never live in a function definition.

Source: https://edesy.in/docs/voice-agent/tools/credential-vault

The credential vault stores API keys and tokens for your workspace, encrypted at rest. Custom HTTP functions reference a credential with a placeholder such as `{{vault.shopify_token}}`, and the secret is filled in only at the moment the request is sent. The secret never appears in the function definition, the prompt or the LLM's context.

## At a glance

| Item | Value |
|------|-------|
| Scope | One vault per workspace |
| Storage | Encrypted at rest |
| Reference syntax | `{{vault.NAME}}` or `{{vault.NAME.FIELD}}` |
| Allowed characters in NAME and FIELD | Letters, digits and underscores; NAME starts with a letter or underscore |
| Where it resolves | URL, headers and body of a custom HTTP function |
| Who can manage it | Owners and admins create, edit and delete; members and viewers can view |
| Usage tracking | Last-used time per credential |

## Provider presets

| Preset | Fields |
|--------|--------|
| Shopify | Store name, access token |
| Stripe | API key |
| Zendesk | Subdomain, email, API token |
| HubSpot | API key |
| SendGrid | API key |
| Twilio | Account SID, auth token |
| Google Calendar | Connected through Google sign-in (OAuth), no fields to type |
| Custom | Any fields you define |

## Add a credential

1. Open the agent's **Tools** tab and expand **Credentials**, or open the vault from settings.
2. Click **Add credential** and pick a preset, or **Custom**.
3. Fill in the fields and save.
4. Copy the reference (for example `{{vault.shopify_store}}`) and paste it into your function's URL, headers or body.

## Use it in a function

```json
{
  "name": "lookup_order",
  "httpMethod": "GET",
  "httpUrl": "https://{{vault.shop.store}}.myshopify.com/admin/api/2024-01/orders/{{order_id}}.json",
  "httpHeaders": {
    "X-Shopify-Access-Token": "{{vault.shop.access_token}}"
  }
}
```

Through the API, bind placeholders to vault credentials with `credentialRefs`:

```json
{
  "httpHeaders": { "Authorization": "Bearer {{vault.ORDER_API_TOKEN}}" },
  "credentialRefs": [
    { "placeholder": "ORDER_API_TOKEN", "vaultSlug": "acme_orders" }
  ]
}
```

When a credential has several fields and you leave out `.FIELD`, the first present field from `api_key`, `apiKey`, `token`, `access_token`, `secret`, `key`, `password` is used.

## Safety rules

- A value the LLM or caller supplies is never expanded as a vault reference. If a caller says "{{vault.x}}", it stays as text.
- If a referenced credential is missing or inactive, the function fails closed instead of sending the request without it. The dashboard flags the broken mapping on the function.
- Rotate a key by editing the credential. Every function that references it picks up the new value on its next call.

## FAQs

**Can the agent read my API key?**
No. The key is inserted into the outgoing HTTP request only. The LLM sees the function's name, description, parameters and the response you choose to return.

**Can I use one credential in many functions?**
Yes. That is the point of the vault: update it once and every function uses the new value.

**Are vault credentials the same as BYOK provider keys?**
No. BYOK keys are for AI and speech providers (OpenAI, Deepgram and others). See [BYOK](https://edesy.in/docs/voice-agent/workspace/byok).

## Related

- [Function templates](https://edesy.in/docs/voice-agent/tools/function-templates)
- [Function calling](https://edesy.in/docs/voice-agent/features/function-calling)
- [Security best practices](https://edesy.in/docs/voice-agent/advanced/security)