> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slng.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault

> Store organization-wide variables and secrets in the SLNG Dashboard and reference them from your voice agents with the {{$NAME}} syntax.

The Vault is organization-wide storage for values your agents share. Instead of pasting the same support email into ten prompts, or an API token into every webhook tool, you store the value once and reference it by name.

The Vault holds two kinds of entries:

* [Variables](https://app.slng.ai/vault/variables) — reusable values shown in plain text. Readable and editable after saving, and referenceable anywhere templates are supported.
* [Secrets](https://app.slng.ai/vault/secrets) — write-only credentials. The value is encrypted, hidden after saving, and never shown again. Secrets are only accepted in secret-capable fields, so they can never leak into a prompt or transcript.

Both kinds are encrypted at rest and scoped to your organization. The difference is readability: a variable's value stays visible in the Dashboard, a secret's does not.

<Note>
  Organization admins can create, edit, rotate, and delete Vault entries. Members can view the entries and copy references, but cannot change them.
</Note>

## Reference syntax

Every Vault entry is referenced as:

```text theme={null}
{{$NAME}}
```

Names are SCREAMING\_SNAKE\_CASE: they start with a capital letter, followed by capital letters, digits, or underscores (for example `SUPPORT_EMAIL` or `STRIPE_API_KEY`).

The `$` prefix is what routes the reference to your organization's Vault. It is distinct from [template variables](/examples/agents-config#template-variables) like `{{patient_name}}`, which are agent-local and filled per call at dispatch time:

| Syntax         | Scope              | Resolved from                           |
| -------------- | ------------------ | --------------------------------------- |
| `{{variable}}` | One agent          | Values passed when a call is dispatched |
| `{{$NAME}}`    | Whole organization | The Vault                               |

Each row in the Vault has a copy button that copies the ready-to-paste `{{$NAME}}` reference to your clipboard.

## Where each kind can be used

**Variables** can be referenced in any templated agent field — the system prompt, greetings, and the tool fields that support templates (such as webhook URLs and system webhook argument values). Editing a variable updates every place it is referenced.

**Secrets** cannot be used in templated fields. If you try, the save is rejected with an error explaining that secrets can only be used in secret fields. Secrets are accepted only in secret-capable fields — webhook tool authentication via `secret_ref` — where the value is resolved at dispatch time and never passes through the model.

## Managing entries

### Create

From [Variables](https://app.slng.ai/vault/variables) or [Secrets](https://app.slng.ai/vault/secrets), select **Add variable** or **Add secret**, then enter:

* **Name** — the SCREAMING\_SNAKE\_CASE identifier. Names are locked after creation so existing references stay valid.
* **Value** — for a secret, this is the only time you can see what you entered; it is hidden after saving.
* **Description** (variables, optional) — a note on what the value is for.

### Edit and rotate

* **Variables** can be edited: change the value or description, and the change applies everywhere the variable is referenced.
* **Secrets** are rotated, not edited: enter a new value to replace the current one. The current value is hidden and cannot be shown, so rotation always means re-entering the credential in full.

### Delete

The **Used by** column shows how many agents reference each entry; open it to jump to those agents. Deletion is blocked while an entry is still referenced by an agent's active configuration or by an active call — the delete dialog lists the blocking references so you can remove them first. References that exist only in old agent versions or unpublished drafts do not block deletion.

## Webhook authentication with a Vault secret

Webhook tools accept a `secret_ref` in their `auth` block instead of an inline token. The reference names a Vault secret (without the `{{$...}}` wrapper), and the credential is resolved when the webhook runs:

```json theme={null}
{
  "type": "webhook",
  "name": "lookup_order",
  "description": "Look up an order by its ID.",
  "url": "https://api.example.com/orders/{{order_id}}",
  "auth": { "type": "bearer", "secret_ref": "CRM_API_TOKEN" }
}
```

The same works for HMAC-signed webhooks:

```json theme={null}
{
  "auth": { "type": "hmac", "secret_ref": "WEBHOOK_SIGNING_SECRET" }
}
```

Each `auth` block takes exactly one credential source: either the inline value (`token` / `secret`) or a `secret_ref` — not both. With a `secret_ref`, rotating the credential is a single Vault update instead of editing every agent that uses it.

For the full webhook tool reference, see [Agent configuration](/examples/agents-config).

<Note>
  Provider API keys for the models your agents run on are managed separately, on the [Bring your own key](/dashboard/byok) page.
</Note>