Vault stores API keys and other secret values for your Hand. They are held on the selected Hand’s machine and appear masked in the list. Vault is separate from the access key used to connect an AI provider to your Hand.
Find Vault
- Open the Hands Console and select the intended Hand.
- Navigate to My Hand → Vault.
- Use Search keys to filter saved keys by name. The list displays a key name and a concealed value rather than showing the full secret by default.
Vault requires a ready Hand and the necessary account/subscription access. If the tab is disabled, check your Hand’s status. An empty list for one Hand does not mean that other Hands have no stored keys.
Add a new credential
- Select New key.
- Enter a recognizable KEY_NAME, such as the name of the service that uses it.
- Paste the secret into the value field.
- Select Save. Check the confirmation that the value has been stored.
Both a name and a value are required. The key name is normalized on save, including uppercase letters and underscores. Make sure the stored name matches what your Hand or connected tool expects. Avoid posting secrets in ordinary chat messages when Vault can hold them instead.
Reveal, replace or delete a value
- Reveal: select the eye icon beside a key to retrieve and display its value. Select it again to hide the value. Avoid revealing secrets while screen sharing.
- Replace: select the row’s pencil icon. Vault retrieves the existing value into the edit form. Update it and choose Save, then verify that the affected service still works.
- Delete: select the trash icon and confirm. Deleting a key may revoke linked custom MCP connection credentials. Deleting the Vault entry does not itself revoke a credential at the external provider.
Vault rows offer reveal, edit and delete actions; do not expect a dedicated copy-value control. Hide a revealed value once you no longer need to see it.
Secrets are not the same as access permissions
A Vault key is a stored secret a Hand may use for a service. The Access key under My Hand → Hand profile connects an AI provider to your Hand. Integration permissions and provider OAuth grants separately determine what services are allowed to do. Merely saving a secret does not enable every action.
If a service stops working, check the stored key name and value, then inspect the integration and its authorization. If a key is exposed, revoke or rotate it at the external provider as well; deleting its Vault entry is not sufficient.
A checkpoint captures machine state, not a guarantee that external secrets, provider permissions or connections will become valid again.
Related guides
Set up My Hand and manage access · Connect an MCP server securely · Create and restore checkpoints