What is an API key vault?
Encrypted storage for credentials that an application reads at runtime, never displayed again anywhere a person or a log can see it.
Secrets vault — A secrets vault is encrypted storage for credentials, API keys, tokens, passwords, from which an application reads at runtime. The values are never visible in settings screens, logs or exports. It is where a customer's BYOK key belongs.
Also known as: API key vault
Why it matters
A secrets vault exists because credentials are the keys to whatever system they authenticate against. API keys, tokens, and passwords. Anyone who can read them can act as if they were the account owner. Storing them in a vault means the application can retrieve and use a credential at the moment it needs it. The value is never displayed back to a user, written into a log file, or included in a database export where anyone with access to that export could read it.
The failure a vault prevents is the plain settings table. A screen where a user pastes in an API key, and the value sits, readable, in a database row that any admin, any backup, and any database export can see. Convenient for a developer building the feature quickly. But the credential's security then depends on every downstream system that ever touches that table, rather than on the vault's own access controls. This matters directly for BYOK arrangements. A customer's own AI provider key is exactly the kind of credential that has to be stored this way. Encrypted, write-only from the interface's perspective, and never displayed again once it is saved.
How a secrets vault is used
- 1
A credential is entered
A user submits an API key, token or password through a form.
- 2
It is encrypted on the way in
The value is encrypted before it is written to storage.
- 3
It is never displayed again
The interface shows only that a credential is set, not its value.
- 4
The application reads it at runtime
The vault decrypts and supplies the credential only when the application needs it.
- 5
Access is logged separately
Reads of the vault are tracked apart from the credential's own value.
The mistake to watch for
Questions
- How is a secrets vault different from environment variables?
- Environment variables are typically set once per deployment and are the same for every user of that deployment. A secrets vault stores per-customer or per-user credentials that can be added, rotated or removed at runtime without redeploying anything.
- Should an API key ever be shown again after it's saved?
- No. Once a credential is stored in a vault, the interface should confirm it is set without displaying the value again. Anyone who can view it afterward defeats the purpose of storing it securely.
- Why does a BYOK key need vault storage specifically?
- A bring-your-own-key arrangement means the customer's own account and billing are tied to that key. If it is stored in plain text, anyone with database access could use it, running charges or actions against the customer's own provider account.