[{"data":1,"prerenderedAt":75},["ShallowReactive",2],{"help-article-the-secret-vault":3},{"data":4},{"title":5,"excerpt":6,"content":7,"help_category":8,"seo":11},"The Secret Vault","The Vault stores your API keys encrypted at rest with AES-256-GCM, referenced by name not value. Learn what it holds, how keys resolve at runtime, and how to","\u003Cp>\u003Cstrong>What you'll learn\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>What the Vault is, what it stores, and what it deliberately does \u003Cem>not\u003C\u002Fem> store.\u003C\u002Fli>\n\u003Cli>The difference between what you see in the UI (key names) and what the database holds (ciphertext).\u003C\u002Fli>\n\u003Cli>How to rotate a key once and have every connection pick it up.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Chr>\n\u003Ch2>The concept: store the value once, reference it by name\u003C\u002Fh2>\n\u003Cp>m18t talks to outside services on your behalf — AI providers, social platforms, your headless CMS. To do that it needs real credentials: an OpenAI key, a Meta access token, a Strapi API token. Those are sensitive. A token with write access to your CMS or your Facebook Page is, in the wrong hands, a way to vandalise your brand.\u003C\u002Fp>\n\u003Cp>So m18t never keeps those raw values lying around. It keeps them in the \u003Cstrong>Vault\u003C\u002Fstrong>: encrypted at rest with AES-256-GCM, decrypted only for the instant a call is made, and referenced everywhere else by a name you choose. You see \u003Ccode>OPENAI_API_KEY\u003C\u002Fcode>; the database holds ciphertext.\u003C\u002Fp>\n\u003Cp>You reach the Vault at \u003Cstrong>Business Settings → Connections\u003C\u002Fstrong> (\u003Ccode>\u002Fstudio\u002Fbusiness\u002Fconnections\u003C\u002Fcode>), on the \u003Cstrong>Vault\u003C\u002Fstrong> tab. The tab carries its own note: \u003Cem>"Where your raw keys live, encrypted at rest with AES-256-GCM. Connections reference these by name. Most workspaces never need to touch this directly — it's here for rotations and audits."\u003C\u002Fem> That last line is the honest framing: in normal use you add keys \u003Cem>through\u003C\u002Fem> the connection wizard, not here. The Vault tab is the place to rotate and audit them later.\u003C\u002Fp>\n\u003Ch2>What's actually in the Vault — and what isn't\u003C\u002Fh2>\n\u003Cp>The Vault holds credentials for \u003Cstrong>AI providers\u003C\u002Fstrong> (OpenAI, Google\u002FGemini, Anthropic), \u003Cstrong>social APIs\u003C\u002Fstrong> (Meta Graph), \u003Cstrong>CMS tokens\u003C\u002Fstrong> (Strapi), analytics keys, and SMTP passwords. Those all use the encrypted Vault path.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Storage credentials are the exception today.\u003C\u002Fstrong> m18t's object storage is configured at the platform level right now, not per-workspace in the Vault — a deliberate temporary bypass while per-workspace BYOK storage is built as its own beta feature. Workspace isolation for storage is enforced at the bucket level (each workspace gets its own isolated bucket), not via per-workspace credentials. So if you're looking for "where do I put my S3 keys" — for most users that's nowhere; see \u003Ca href=\"\u002Fhelp\u002Fconnect-minio-storage\">Where Your Files Live\u003C\u002Fa> for the full picture.\u003C\u002Fp>\n\u003Ch2>How a key moves through the system\u003C\u002Fh2>\n\u003Cp>When you save a key, it follows a fixed path:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>In memory, briefly.\u003C\u002Fstrong> You paste the raw value into the form and submit. It travels to the server, lives in memory long enough to be encrypted, and is not written to logs or a temp cache.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Encrypted at rest.\u003C\u002Fstrong> Before anything is persisted, the raw value is encrypted with AES-256-GCM using a server-side master key. The encrypted secret is stored in your encrypted secret vault — not as plain text.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Resolved at runtime.\u003C\u002Fstrong> When an action needs the credential — publishing to Meta, generating an image — the server resolves the reference, decrypts the value in memory, makes the call, and drops the decrypted value. The raw key is never returned to your browser and never logged.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>The resolution is three-tier. A connection's token field can hold \u003Ccode>vault:KEY_NAME\u003C\u002Fcode> (look it up in the workspace Vault), \u003Ccode>env:VAR_NAME\u003C\u002Fcode> (fall back to a platform environment variable — legacy path), or a literal value (used as-is, not recommended). New connections use \u003Ccode>vault:\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Ch2>Adding and naming keys\u003C\u002Fh2>\n\u003Cp>You'll usually add a key without visiting the Vault tab at all. In the \u003Ca href=\"\u002Fhelp\u002Fper-brand-integrations\">connection wizard\u003C\u002Fa>, the Authentication step lets you pick an existing Vault key \u003Cem>or\u003C\u002Fem> add a new one inline — name it, paste the value, and it's saved as \u003Ccode>vault:YOUR_KEY_NAME\u003C\u002Fcode> and selected for that connection in one move.\u003C\u002Fp>\n\u003Cp>If you do add a key directly on the Vault tab, the \u003Cstrong>Add Key\u003C\u002Fstrong> button opens a small form with three fields:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Key\u003C\u002Fstrong> — the reference name. The convention is \u003Ccode>UPPERCASE_WITH_UNDERSCORES\u003C\u002Fcode>, e.g. \u003Ccode>OPENAI_API_KEY\u003C\u002Fcode> or \u003Ccode>CMS_PROD_API_TOKEN\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Value\u003C\u002Fstrong> — the raw secret. This is the only time you paste it; afterward the UI shows only the name.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Category\u003C\u002Fstrong> — one of AI, CMS, Social, Storage, or General, for organisation.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The \u003Cstrong>Key\u003C\u002Fstrong> name is stored in plain text on purpose — it's a label, not a secret. The \u003Cstrong>Value\u003C\u002Fstrong> is what gets encrypted.\u003C\u002Fp>\n\u003Ch2>Rotating a key\u003C\u002Fh2>\n\u003Cp>This is where the name-not-value design earns its keep. Say an OpenAI key is compromised, and ten brands across your workspace reference it as \u003Ccode>vault:OPENAI_API_KEY\u003C\u002Fcode>. You do not edit ten connections:\u003C\u002Fp>\n\u003Col>\n\u003Cli>Revoke the old key in OpenAI's dashboard and generate a new one.\u003C\u002Fli>\n\u003Cli>On the Vault tab, find \u003Ccode>OPENAI_API_KEY\u003C\u002Fcode> and use its \u003Cstrong>Rotate\u003C\u002Fstrong> action.\u003C\u002Fli>\n\u003Cli>Paste the new value and save.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Every connection that references \u003Ccode>vault:OPENAI_API_KEY\u003C\u002Fcode> resolves the new value on its next call. One update, whole workspace. The Vault tab also shows, per key, how many connections use it ("Used by 3 connections"), so you can see the blast radius before you rotate.\u003C\u002Fp>\n\u003Ch2>A note on what "secure" means here\u003C\u002Fh2>\n\u003Cp>AES-256-GCM at rest is real and live for every Vault secret. What that protects against is a dumped database file: an attacker who got the underlying database would see ciphertext, not your keys. It is not a claim that no precaution is ever needed on your side — protect your own provider accounts, set spending caps, and revoke keys you suspect. The Vault makes m18t a safe place to \u003Cem>store\u003C\u002Fem> the credential; the rest of the chain is still yours to mind.\u003C\u002Fp>\n\u003Ch2>FAQ\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Can I see a key's raw value after I save it?\u003C\u002Fstrong>\nNo. The UI shows only the reference name. The raw value is encrypted and never returned to the browser. If you've lost the original, generate a new one at the provider and rotate.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Do I have to use the Vault tab to add keys?\u003C\u002Fstrong>\nNo — most of the time you'll add a key inline while creating a \u003Ca href=\"\u002Fhelp\u002Fper-brand-integrations\">connection\u003C\u002Fa>. The Vault tab is for rotating and auditing existing keys.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Where do storage (S3\u002FMinIO) credentials go?\u003C\u002Fstrong>\nNot the Vault, today. Storage is configured at the platform level as a temporary measure; isolation is per-bucket. See \u003Ca href=\"\u002Fhelp\u002Fconnect-minio-storage\">Where Your Files Live\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>My connection says "vault key missing" — what happened?\u003C\u002Fstrong>\nThe connection references a \u003Ccode>vault:\u003C\u002Fcode> name that has no stored value (often after a brand copy, or if a key was removed). Re-add the key under that exact name on the Vault tab, or edit the connection to point at an existing key.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>If I rotate a key, do I have to republish or reconnect anything?\u003C\u002Fstrong>\nNo. Connections reference the name, not the value, so the next call uses the new value automatically.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>What's next\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Get a key to store: \u003Ca href=\"\u002Fhelp\u002Fget-an-openai-key\">Get an OpenAI API Key\u003C\u002Fa>, \u003Ca href=\"\u002Fhelp\u002Fget-a-gemini-key\">Gemini\u003C\u002Fa>, \u003Ca href=\"\u002Fhelp\u002Fget-an-anthropic-key\">Anthropic\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>See how keys map per brand, including sharing one key across brands: \u003Ca href=\"\u002Fhelp\u002Fper-brand-integrations\">Per-Brand Integrations\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>Understand why the keys are yours in the first place: \u003Ca href=\"\u002Fhelp\u002Fbyok-why-we-do-this\">Why m18t uses BYOK\u003C\u002Fa>.\u003C\u002Fli>\n\u003C\u002Ful>\n",{"slug":9,"title":10},"connections-and-keys","Connections & API Keys",{"meta_title":12,"meta_description":6,"keywords":13,"canonical_url":14,"og_title":5,"og_description":15,"og_image":16,"robots":17,"json_ld":18},"The Secret Vault | m18t Help","secret vault, AES-256-GCM, encrypted api keys, key rotation, vault key reference, m18t credentials, business secret","https:\u002F\u002Fm18t.com\u002Fhelp\u002Fthe-secret-vault","Keys stored as ciphertext, referenced by name, resolved only at call time. Rotate once and every connection picks it up.","https:\u002F\u002Fm18t.com\u002Fog-default.png","index, follow",{"@context":19,"@graph":20},"https:\u002F\u002Fschema.org",[21,34,59],{"@type":22,"headline":5,"description":6,"articleSection":10,"inLanguage":23,"datePublished":24,"dateModified":24,"image":16,"author":25,"publisher":29,"mainEntityOfPage":32},"Article","en","2026-06-25",{"@type":26,"name":27,"url":28},"Organization","m18t","https:\u002F\u002Fm18t.com",{"@type":26,"name":27,"url":28,"logo":30},{"@type":31,"url":16},"ImageObject",{"@type":33,"@id":14},"WebPage",{"@type":35,"mainEntity":36},"FAQPage",[37,43,47,51,55],{"@type":38,"name":39,"acceptedAnswer":40},"Question","Can I see a key's raw value after I save it?",{"@type":41,"text":42},"Answer","No. The UI shows only the reference name. The raw value is encrypted and never returned to the browser. If you've lost the original, generate a new one at the provider and rotate.",{"@type":38,"name":44,"acceptedAnswer":45},"Do I have to use the Vault tab to add keys?",{"@type":41,"text":46},"No — most of the time you'll add a key inline while creating a connection. The Vault tab is for rotating and auditing existing keys.",{"@type":38,"name":48,"acceptedAnswer":49},"Where do storage (S3\u002FMinIO) credentials go?",{"@type":41,"text":50},"Not the Vault, today. Storage is configured at the platform level as a temporary measure; isolation is per-bucket. See Where Your Files Live.",{"@type":38,"name":52,"acceptedAnswer":53},"My connection says vault key missing — what happened?",{"@type":41,"text":54},"The connection references a vault: name that has no stored value (often after a brand copy, or if a key was removed). Re-add the key under that exact name on the Vault tab, or edit the connection to point at an existing key.",{"@type":38,"name":56,"acceptedAnswer":57},"If I rotate a key, do I have to republish or reconnect anything?",{"@type":41,"text":58},"No. Connections reference the name, not the value, so the next call uses the new value automatically.",{"@type":60,"itemListElement":61},"BreadcrumbList",[62,66,70,73],{"@type":63,"position":64,"name":65,"item":28},"ListItem",1,"Home",{"@type":63,"position":67,"name":68,"item":69},2,"Help","https:\u002F\u002Fm18t.com\u002Fhelp",{"@type":63,"position":71,"name":10,"item":72},3,"https:\u002F\u002Fm18t.com\u002Fhelp\u002Fcategories\u002Fconnections-and-keys",{"@type":63,"position":74,"name":5,"item":14},4,1786312168928]