Agent Vault
The built-in encrypted secret store for your hosted agents. Give Super Agents the API keys and tokens they need at runtime — encrypted at rest, write-only by default, and never sitting in plaintext config.
- Per-org encryption
- Owner-only reveal
- Bitwarden compatible
- OPENROUTER_API_KEYAGW Vault••••••••••••Deployedrotated 3d ago
- STRIPE_SECRET_KEYAGW Vault••••••••••••Deploy pendingsyncing to box…
- SLACK_BOT_TOKENBitwarden••••••••••••Deployedrotated 28d ago
- HUBSPOT_PRIVATE_TOKENAGW Vault••••••••••••Deployedrotated 9d ago
Why it exists
Autonomous agents need credentials. Loose credentials are a liability.
A Super Agent that calls Stripe, Slack, or your CRM needs real keys at runtime. Pasting them into env files or machine config means plaintext at rest, no rotation story, and no audit trail. Agent Vault makes secret storage a first-class, encrypted part of the platform — so your agents stay powerful without becoming your biggest exposure.
A vault designed for how agents actually run
Six guarantees that hold from the moment you paste a key to the moment an agent uses it.
Encrypted at rest, per-org keys
Every value is encrypted before it touches storage. New envelopes use org-scoped key material and carry a key version, so each organization is cryptographically isolated and keys can roll without a flag day.
Write-only by default
List screens and API responses return metadata only — name, source, folder, rotation status, deploy state — never plaintext or ciphertext. The value goes in and is never handed back in normal flows.
Rotate without downtime
Save a new value under the same name, watch the deploy-pending state clear after box sync, test the dependent path, then revoke the old upstream credential. No agent restart guesswork.
Owner-only, audited reveal
Human reveal is default-off. When an operator turns it on, it stays owner-only, step-up gated, rate-limited, and logged — reserved for rotation or import, not casual viewing.
Runtime access, no plaintext in config
Agents receive compatible environment variables at runtime through the box-local supervisor overlay. Secrets never persist in durable Fly config.env — skills can resolve a name or vault://box/<NAME> on demand.
First-party or bring-your-own
Use AGW Vault as your first-party encrypted store, or bring Bitwarden with your own BWS_ACCESS_TOKEN. Switching providers is always explicit — enabling one never force-switches or deletes the other.
From paste to runtime
Three steps, zero plaintext
- 01
Store it
In the agent Command Center, open Secrets & Vault, choose AGW Vault, enter an uppercase name like OPENROUTER_API_KEY, paste the value, and save.
- 02
Encrypt & sync
The value is encrypted with org-scoped keys and queued to the box. The row shows deploy-pending until the supervisor receives the updated overlay.
- 03
Run with it
Your agent picks up the secret at runtime as a normal environment variable — pulled from the box-local overlay, never from durable config.
Rotate keys without a flag day
Versioned, org-scoped envelopes mean rotation is routine, not an incident. Save the new value under the same name and the platform handles encryption, sync, and deploy state — your agents never see an interruption.
Start rotating safely- 1.Create the replacement credential with the upstream provider
- 2.Save the new value under the existing secret name
- 3.Wait for deploy-pending to clear after box sync
- 4.Test the dependent agent path, then revoke the old key
Security invariants
The promises that hold on every read, write, and sync
- No plaintext in logs, Fly config.env, audit rows, or API responses
- Owner-only mutation, rotation, and reveal — every action gated
- Per-org key isolation with versioned envelopes for clean rotation
- Reveal is separately default-off and never enabled as a side effect
- Deletion and rollback supported; encrypted rows preserved for investigation
- Bitwarden stays fully supported — no org is ever force-migrated
Keep your agents powerful and your keys locked down.
Agent Vault ships inside Super Agents — encrypted at rest, write-only by default, and built so a key is never the weakest link in your automation.