SemAgentAgent Vault (BYOC)
When the agent acts on your behalf it uses your own credentials: an API token, an SMTP password, a database connection string, an SSH key. The Vault stores them encrypted. BYOC stands for Bring Your Own Credentials.
The core principle: the agent sees the name, not the secret
The Vault's design rests on a single rule:
The agent refers to a secret by name only. The raw value is injected into the relevant tool at execution time and is never sent to the AI model. Your secrets therefore never leak into the model context — not into conversation history, not into logs, and not anywhere a prompt-injection attacker could read them.
In practice this means you can tell the agent "fetch the orders using printify_token". The agent puts that name into a tool call; the execution layer swaps the name for the real value. The model never sees the token itself.
Adding a secret
Open Settings → Agent Vault and fill in the Add / update secret form.
| Field | Required | Description |
|---|---|---|
| Name | Yes | The name the agent will refer to. Keep it short and speakable: printify_token, smtp_pw, shop_db. |
| Kind | No | api_key · token · smtp · db_dsn · ssh_key · other |
| Value | Yes | The token, password, connection string or key. Stored encrypted. |
Note (meta) | No | A reminder to yourself: "production, last rotated 2026-06" |
Saving with an existing name updates the value — that's how you rotate a key. Deleting is permanent.
The value can never be read back. The list shows only a masked form, and there is no way to retrieve the raw value. If you lose a key, generate a new one at the service and overwrite it under the same name.
When do you use the Vault by hand?
Usually you don't — connecting a connector writes the fields into the Vault automatically. Adding a secret manually is needed in three cases:
- Using a "Coming soon" service. For catalog services that don't auto-connect (Slack, Meta Ads, Canva, Stripe…), you add the token to the Vault and ask the agent to call the service with
http_request. Because the target isn't on your egress list, the request goes to approval — but it works. - Authenticating an MCP server. On the MCP screen you enter the secret name, not the token itself.
- Referring to a secret in the charter. You can write instructions like "use the
shop_dbconnection for reports".
Secret names created by connectors
After connecting a connector you'll see unfamiliar names in the Vault list. That's expected — a connector stores each field as its own secret:
| Connector | Secret names it creates |
|---|---|
| Email (SMTP) | smtp_host, smtp_port, smtp_user, smtp_password, smtp_from, smtp_from_name |
| SMS (Twilio) | twilio_account_sid, twilio_auth_token, twilio_from |
| SMS (NetGSM) | netgsm_usercode, netgsm_password, netgsm_header |
| Gmail (IMAP) | gmail_address, gmail_app_password |
| WhatsApp Business | whatsapp_phone_number_id, whatsapp_access_token |
| Shopify (Admin API) | shopify_shop_domain, shopify_client_id, shopify_client_secret |
| Printify · Notion · Etsy · Google | A single secret: Printify, Notion, Etsy, Google |
Deleting these secrets by hand will break the corresponding connector. If you want to remove a connection, use the Disconnect button on the connector card instead — it's cleaner.
What happens to secrets on disconnect?
- SMTP and field-based connectors (Twilio, NetGSM, Gmail IMAP, Shopify Admin…) → secrets are deleted.
- Printify, Notion, Etsy and the Google connectors → the domain leaves the allow-list, but the secret stays in the Vault. Delete it manually to clean up fully.
Security notes
- Values are stored encrypted and isolated to your tenant.
- The raw value is never sent to the model, never returned by the API, and never leaks into test output.
- A connector card shows a secret as "present in the Vault" — its existence, not its value.
- Give keys the narrowest scope that works: if read-only suffices, don't grant write access.
- Rotate regularly; recording the last rotation date in the Note field helps.
For the Vault's place in the threat model and its role against prompt injection: Security architecture.