Vault

The Vault is organization-wide storage for values your agents share. Instead of pasting the same support email into ten prompts, or an API token into every webhook tool, you store the value once and reference it by name. The Vault holds two kinds of entries:

Variables — reusable values shown in plain text. Readable and editable after saving, and referenceable anywhere templates are supported.
Secrets — write-only credentials. The value is encrypted, hidden after saving, and never shown again. Secrets are only accepted in secret-capable fields, so they can never leak into a prompt or transcript.

Both kinds are encrypted at rest and scoped to your organization. The difference is readability: a variable’s value stays visible in the Dashboard, a secret’s does not.

Organization admins can create, edit, rotate, and delete Vault entries. Members can view the entries and copy references, but cannot change them.

Reference syntax

Every Vault entry is referenced as:

{{$NAME}}

Names are SCREAMING_SNAKE_CASE: they start with a capital letter, followed by capital letters, digits, or underscores (for example SUPPORT_EMAIL or STRIPE_API_KEY). The $ prefix is what routes the reference to your organization’s Vault. It is distinct from template variables like {{patient_name}}, which are agent-local and filled per call at dispatch time:

Syntax	Scope	Resolved from
`{{variable}}`	One agent	Values passed when a call is dispatched
`{{$NAME}}`	Whole organization	The Vault

Each row in the Vault has a copy button that copies the ready-to-paste {{$NAME}} reference to your clipboard.

Where each kind can be used

Variables can be referenced in any templated agent field — the system prompt, greetings, and the tool fields that support templates (such as webhook URLs and system webhook argument values). Editing a variable updates every place it is referenced. Secrets cannot be used in templated fields. If you try, the save is rejected with an error explaining that secrets can only be used in secret fields. Secrets are accepted only in secret-capable fields — webhook tool authentication via secret_ref — where the value is resolved at dispatch time and never passes through the model.

Managing entries

Create

From Variables or Secrets, select Add variable or Add secret, then enter:

Name — the SCREAMING_SNAKE_CASE identifier. Names are locked after creation so existing references stay valid.
Value — for a secret, this is the only time you can see what you entered; it is hidden after saving.
Description (variables, optional) — a note on what the value is for.

Edit and rotate

Variables can be edited: change the value or description, and the change applies everywhere the variable is referenced.
Secrets are rotated, not edited: enter a new value to replace the current one. The current value is hidden and cannot be shown, so rotation always means re-entering the credential in full.

Delete

The Used by column shows how many agents reference each entry; open it to jump to those agents. Deletion is blocked while an entry is still referenced by an agent’s active configuration or by an active call — the delete dialog lists the blocking references so you can remove them first. References that exist only in old agent versions or unpublished drafts do not block deletion.

Webhook authentication with a Vault secret

Webhook tools accept a secret_ref in their auth block instead of an inline token. The reference names a Vault secret (without the {{$...}} wrapper), and the credential is resolved when the webhook runs:

{
  "type": "webhook",
  "name": "lookup_order",
  "description": "Look up an order by its ID.",
  "url": "https://api.example.com/orders/{{order_id}}",
  "auth": { "type": "bearer", "secret_ref": "CRM_API_TOKEN" }
}

The same works for HMAC-signed webhooks:

{
  "auth": { "type": "hmac", "secret_ref": "WEBHOOK_SIGNING_SECRET" }
}

Each auth block takes exactly one credential source: either the inline value (token / secret) or a secret_ref — not both. With a secret_ref, rotating the credential is a single Vault update instead of editing every agent that uses it. For the full webhook tool reference, see Agent configuration.

Provider API keys for the models your agents run on are managed separately, on the Bring your own key page.

Get started

Text-to-Speech

Speech-to-Text

Managed Agents

Integrations

SDKs & Tools

Reference

Reference syntax

Where each kind can be used

Managing entries

Create

Edit and rotate

Delete

Webhook authentication with a Vault secret

​Reference syntax

​Where each kind can be used

​Managing entries

​Create

​Edit and rotate

​Delete

​Webhook authentication with a Vault secret

Reference syntax

Where each kind can be used

Managing entries

Create

Edit and rotate

Delete

Webhook authentication with a Vault secret