Browse documentation

Vaults

Store the credentials agents need securely in a vault.

When an agent uses a connector to reach an outside service, it needs credentials: an API key or an OAuth grant. Those credentials live in a vault. The agent is bound to a vault and reads from it at run time, so secrets never have to be pasted into the agent itself.

Open the Vaults page

  1. In the left sidebar, open the Settings tab.
  2. Under Agent, select Vaults.

The page has two sections:

  • Personal vault: your private vault. Credentials stored here are visible only to you.
  • Shared vaults: vaults teammates can reuse across their agents.

Each vault shows how many credentials and how many agents it holds, with a Personal or Shared badge.

The Vaults page with a Personal vault section and a Shared vaults section, each vault showing its credential and agent counts.
The Vaults page: your Personal vault, and any Shared vaults for the team.

Create a shared vault

  1. On the Vaults page, click Create shared vault.
  2. Give it a Name and an optional Description.
  3. Click Create. Spark drops you straight into the new vault so you can add credentials.
The Create shared vault dialog with Name and Description fields.
The Create shared vault dialog: name it and add an optional description.

Add a credential

  1. Open a vault (from its more menu (⋮), choose Edit).
  2. In the Credentials section, click Add credential and pick a connector.
  3. In the Connect dialog, provide the credential and choose where to store it:
    • For an API key connector, paste the key.
    • For an OAuth connector, supply the Client ID and Client Secret, then grant access on the provider. Register the shown redirect URI in the provider's app first.

Only active connectors that authenticate with an API key or OAuth can be added.

The Connect dialog for an API-key connector, with a masked API Key field and a Save button.
An API-key connector: paste the key, then Save it into the vault.

Bind a vault to an agent

In the agent editor, use the Vault field to choose which vault the agent reads from. If any of the agent's tools come from a connector that needs credentials, a vault is required. The vault's detail page also lists the Agents using this vault, so you can see what depends on it.

The agent editor's Vault field open, listing the Personal and Shared vaults to choose from.
The agent editor's Vault field: pick the vault the agent reads credentials from.
Use a personal vault for credentials only you should hold, and a shared vault when several teammates or agents need the same access.

Where to go next