Keep secrets out of your collections

A secret you can share a collection around

The awkward part of sharing an API collection is that the useful version contains credentials. Vault separates the reference from the value so the collection can travel and the secret cannot.

Store the secret

Vault is a local-first encrypted store built into the desktop app. Secrets are encrypted at rest using your OS keychain — macOS Keychain, Windows Credential Manager, or Linux Secret Service.

Reference it in a request

Use {{vault:key}} anywhere a value belongs — a URL, a header, an auth field, a request body:

Authorization: Bearer {{vault:my-api-key}}

At send time the reference resolves. Everywhere else — the editor, console output, exports, cloud sync — it stays a reference.

Pull from an external provider

External providers let you pull centrally managed credentials into the same {{vault:key}} namespace, so a request does not need to know whether a secret is local or came from AWS Secrets Manager. On eligible plans, with a signed-in cloud project.