Vaults

When an agent uses a connector to reach an outside service, or runs on your own model provider's key, it needs credentials: an API key, an OAuth grant or a service account key. Those credentials live in a vault. The agent is bound to a vault and reads from it at run time, so secrets never have to be pasted into the agent itself.

Open the Vaults page

Open Agent Studio, then Vaults. The page, Personal and shared credentials your agents use for other services. Credentials in your personal vault are only visible to you., lists every vault you can use in one list:

• Your personal vault first, named after you (such as Claire's vault), with a lock. It is created for you when you first sign in, and it cannot be deleted.
• Shared vaults after it, with a people icon: vaults the whole workspace can use.

Each row shows how many credentials and agents the vault holds, and its ⋯ has Open vault and Delete. Click a row to open the vault. New Shared Vault at the top makes another.

How vaults work

The ? beside New Shared Vault opens How vaults work: A vault holds the model keys and app connections your agents use.

Your personal vault

• Only you see it, and only you can put an agent on it.
• Its connections work only when you ask. When a teammate asks, the agent answers without them, and says so when it needs one.
• Its model keys pay for every turn, a teammate's too.
• Workflows never use its connections, even yours.

Shared vaults

• Their connections work for everyone, in agents and in workflows.
• Some connectors, such as OpenFIGI, connect only here.

Create a shared vault

1. On the Vaults page, click New Shared Vault.
2. In Create shared vault (Shared vaults let teammates reuse the same credentials in their agents.), give it a Name and, optionally, a Description.
3. Click Create. SPARK says Shared vault created and opens the new vault so you can add credentials.

Inside a vault

A vault's page carries its name and a Personal or Shared badge, then three parts:

• LLM provider keys: Agents bound to this vault run on these keys instead of the platform's. Click Add provider key and pick a provider. Only providers switched on in Agent Studio > Models are offered, so with none switched on the button is disabled and the part says how to add one; see Models.
• MCP connector keys: Integration credentials this vault provides to its agents. Click Add credential and pick a connector. Only active connectors that need a connection are offered, each once, and a personal vault does not offer the connectors that connect only in a shared vault, such as OpenFIGI.
• Agents using this vault: every agent currently bound to it, so you can see what depends on it.

A connection shows the account it acts as. A working one carries no badge; one that needs you shows Pending, Expired or Revoked. An expired connection needs connecting again: see Connect an account. A row's ⋯ deletes the credential.

Add a credential

1. Open the vault.
2. In MCP connector keys, click Add credential and pick a connector.
3. In the Connect dialog, provide the credential.

What the dialog asks for depends on how the connector signs in, and a badge on the dialog says which it is:

Connect an account walks through each one, including which redirect URI to register when you bring your own OAuth app. You can also connect from the Connectors page, choosing the vault in the dialog.

Bind a vault to an agent

On the agent's page, use the Vault section to choose which vault the agent reads from. Its list offers No vault, your own vault under Personal, and the workspace's under Shared. If any of the agent's tools come from a connector that needs a connection, a vault is required. If the vault lacks a connection one of those tools needs, the section shows Missing credentials with the connector's name.

The vault also decides which models the agent can pick: models on your own provider keys appear only when the agent's vault holds that provider's key.

Personal vaults stay personal

An agent running on a vault acts as that vault's accounts and bills its model keys, so a personal vault serves its owner:

• Only you can put an agent on it. No one else can pick it for an agent, and an agent cannot bind one either. An agent already bound to a personal vault stays bound.
• Its connections work only when you ask. When a teammate asks the same agent in a thread, it answers without your connections and says so when it needs one. Your model keys still pay for that turn.
• Workflows never use its connections, even yours. A workflow's steps read connections from shared vaults only.

If you open an agent that uses another member's personal vault, its Preview says This agent uses another member's personal vault and asks you to choose your own vault or a shared one to preview it.

Delete a vault

Choose Delete from a shared vault's ⋯ and confirm: the vault and its credentials are deleted permanently. While agents still use the vault, Delete is unavailable and says why: Move the agents using this vault to another one first. A personal vault cannot be deleted.

OAuth connections stay live on their own

An OAuth connection does not need re-authorising for each agent, or again when its token expires. SPARK holds the connection centrally and issues a fresh token whenever an agent runs, so one connection serves every agent bound to that vault.

Where to go next

• Connect an account
• Models
• Connectors (MCP)
• Create an agent