> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slng.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault

> Store organization-wide variables and secrets in the SLNG Dashboard and reference them from your voice agents with the {{$NAME}} syntax.

The Vault is organization-wide storage for values your agents share. Instead of pasting the same support email into ten prompts, or an API token into every tool, you store the value once and reference it by name.

The Vault holds two kinds of entries:

* [Variables](https://app.slng.ai/vault/variables) — reusable values shown in plain text. Readable and editable after saving, and referenceable anywhere templates are supported.
* [Secrets](https://app.slng.ai/vault/secrets) — write-only credentials. The value is encrypted, hidden after saving, and never shown again. Secrets are only accepted in secret-capable fields, so they can never leak into a prompt or transcript.

Both kinds are encrypted at rest and scoped to your organization. The difference is readability: a variable's value stays visible in the Dashboard, a secret's does not.

<Note>
  Organization admins can create, edit, rotate, and delete Vault entries. Members can view the entries and copy references, but cannot change them.
</Note>

## Reference syntax

Every Vault entry is referenced as:

```text theme={null}
{{$NAME}}
```

Names are SCREAMING\_SNAKE\_CASE: they start with a capital letter, followed by capital letters, digits, or underscores (for example `SUPPORT_EMAIL` or `STRIPE_API_KEY`).

The `$` prefix is what routes the reference to your organization's Vault. It is distinct from [template variables](/examples/agents-config#template-variables) like `{{patient_name}}`, which are agent-local and filled per call at dispatch time:

| Syntax         | Scope              | Resolved from                           |
| -------------- | ------------------ | --------------------------------------- |
| `{{variable}}` | One agent          | Values passed when a call is dispatched |
| `{{$NAME}}`    | Whole organization | The Vault                               |

Each row in the Vault has a copy button that copies the ready-to-paste `{{$NAME}}` reference to your clipboard.

## Where each kind can be used

**Variables** can be referenced in any templated agent field, including prompts, greetings, attachment arguments, and supported tool configuration fields. Editing a variable updates every place it is referenced.

**Secrets** cannot be used in templated fields. They are accepted only in secret-capable fields: API Request and MCP authentication, secret-backed headers, and a Custom Code tool's `declared_secrets`. The value is resolved when the tool runs and never passes through the model.

## Managing entries

### Create

From [Variables](https://app.slng.ai/vault/variables) or [Secrets](https://app.slng.ai/vault/secrets), select **Add variable** or **Add secret**, then enter:

* **Name** — the SCREAMING\_SNAKE\_CASE identifier. Names are locked after creation so existing references stay valid.
* **Value** — for a secret, this is the only time you can see what you entered; it is hidden after saving.
* **Description** (variables, optional) — a note on what the value is for.

### Edit and rotate

* **Variables** can be edited: change the value or description, and the change applies everywhere the variable is referenced.
* **Secrets** are rotated, not edited: enter a new value to replace the current one. The current value is hidden and cannot be shown, so rotation always means re-entering the credential in full.

### Delete

The **Used by** column shows how many agents reference each entry; open it to jump to those agents. Deletion is blocked while an entry is still referenced by an agent's active configuration or by an active call — the delete dialog lists the blocking references so you can remove them first. References that exist only in old agent versions or unpublished drafts do not block deletion.

## Tool authentication with a Vault secret

API Request tools reference the bare Vault name through `secret_name`. The credential is resolved only when the request runs:

```json theme={null}
{
  "tool_type": "api_request",
  "name": "lookup_order",
  "description": "Look up an order by its ID.",
  "config": {
    "type": "api_request",
    "url": "https://api.example.com/orders/lookup",
    "auth": { "type": "bearer", "secret_name": "CRM_API_TOKEN" }
  }
}
```

The same field supports HMAC request signing:

```json theme={null}
{
  "auth": { "type": "hmac", "secret_name": "WEBHOOK_SIGNING_SECRET" }
}
```

MCP servers use the same bare-name pattern in `auth.secret_name` and Vault-backed headers. Custom Code lists the environment secrets it needs in `declared_secrets`. Rotating any referenced secret is one Vault update instead of an edit to every attached agent.

For the complete lifecycle, see [Agent tools](/examples/agents-config#tools).

<Note>
  Provider API keys for the models your agents run on are managed separately, on the [Bring your own key](/dashboard/byok) page.
</Note>