Store API keys and tokens once, use them across every agent, MCP server, skill, and channel. With rotation that propagates instantly and secrets that are never exposed.
Paste a token once. Every agent, MCP server, skill, and channel that needs it picks it up automatically. Rotate the key from one screen and every consumer updates on the next invocation: no re-binding, no config sweeps.
The Credentials Vault is the single place where Actionist stores every secret your agents need to reach the outside world. Everything in it renders as a credential card, whether you typed the value or an OAuth flow created it for you.
Secrets you paste
A raw secret you own and manage: an API key, personal access token, header secret, or client credentials pair. You paste the value, Actionist encrypts it, and the value is never shown again after save.
Secrets OAuth creates
Completing an OAuth consent screen produces a credential too. You never type a value; the install flow creates it. It appears as an ordinary card, identified by its provider and kind slug, for example gitlab · oauth_bundle.
The vault does not separate these into two labelled object types. OAuth-backed entries sit in the same list as everything else. The way to spot one is the oauth_bundle kind in its provider slug.
Each card shows a color-coded key medallion, display name, status badge, binding-count pill, provider/kind slug, and relative last-updated time. Five action buttons appear on every card: Rename, Rotate, Test now, Disable / Enable, and Delete. Which ones are usable shifts with the credential’s state. Pick a state:
SendGrid · productionsendgrid · api-key6 bindings
ActiveInvalidDisabledNeeds re-auth
RenameRotateTest nowDisableDelete
RenameRotateTest nowDisableDelete
RenameRotateEnableDelete
RenameRotateDisableDelete
Active: available for new and existing bindings. All five actions are available, including Delete.
Invalid: the backend determined the secret is no longer valid (expired, revoked, or quota-blocked). Run Test now to see the failure reason, then Rotate with a fresh value to restore it. All bindings remain intact while you rotate.
Disabled: paused manually. Cannot be selected in new bindings, but all binding metadata is preserved. Rotate is locked: re-enable the credential first, then rotate the value. Click Enable to restore instantly.
Needs re-auth: the stored token requires re-authorization. There is no Re-authenticate button. Workaround: create a fresh credential for the same provider with Add credential, then re-bind every consumer to it. Disable or delete the stale credential once migrated.
The value field reads “Saved encrypted; never shown after save.” This is by design. To update a saved secret, use Rotate: not delete-and-recreate.
Go to Settings and expand the Credentials Vault panel. It is a card on the Settings page rather than a separate tab, so nothing is visible until you expand it. Once open you get the stored and binding counts, a Search credentials field, Refresh, Add credential, and the credential cards themselves.
4 credentials stored
6 active bindings
Search credentials…RefreshAdd credential
SendGrid · productionsendgrid · api-key3 bindings
Active
RenameRotateTest nowDisableDelete
GitHub PAT · workgithub · token0 bindings
Disabled
RenameRotateEnableDelete
Stripe · livestripe · api-key2 bindings
Invalid
RenameRotateTest nowDisableDelete
Most users find the vault nearly empty at first. When you paste a token while installing an MCP or configuring an agent’s bot channel, Actionist saves it automatically. Use the vault to manage what has already been saved, or to add credentials you want available before you start building.
Click Add credential in the toolbar and an inline form expands. Three fields are required: Display name (for example GitHub PAT - work), Provider (lowercase identifier: github, sendgrid, slack), and Value (password-masked). Submitting an empty form tells you exactly that: “Display name, provider, and value are required.”Kind is a dropdown that defaults to API key, so you never have to touch it, but change it when the secret is a token, header secret, or client credentials pair. Click Save credential and it appears with an Active badge immediately.
Click Rename. The display name becomes an inline input. Press Enter to save or Escape to cancel. Provider tag and kind are unchanged. All bound consumers keep working.
Rotate
Rotate replaces the stored secret while keeping every binding intact. The next time any bound consumer runs, it picks up the new value automatically, no re-wiring needed.Click Rotate, paste the new secret in the New value field, and press Enter. The banner confirms: “Existing bindings keep working — they pick up the new value on next use.”
Rotation is the only way to update a saved secret. You cannot rotate a disabled credential, re-enable it first.
SendGrid, productionActive
New value
••••••••••••••••••••••••Show
Existing bindings keep working. They pick up the new value on next use.
SaveCancel
Disable and re-enable
Click Disable. The status changes to Disabled and the button becomes Enable (green). Disabled credentials cannot be selected in new bindings, but all binding metadata is preserved. Click Enable to restore, instant and reversible.
Prefer Disable over Delete for temporary pauses. Re-enabling is instant; deleting requires re-binding every consumer.
Delete
Click Delete and confirm. The credential is permanently removed.
Nothing stops you deleting a credential that is still in use. There is no binding check and no confirmation that counts consumers for you. If an agent, MCP, skill, channel, or workflow is bound to the credential you delete, it breaks the next time it runs.Check the binding-count pill on the card before you delete, and migrate those consumers to another credential first. When in doubt, use Disable: it stops the credential being used, keeps the binding metadata, and is instantly reversible.
The binding-count pill on each card tells you how many consumers depend on that credential, but nothing enforces it. A credential with active bindings deletes exactly as readily as one with none.
Read the binding pill. If it says anything other than 0 bindings, something is depending on this credential right now.
Migrate, then delete. Point each bound agent, MCP, skill, channel, or workflow at the replacement credential before you remove the old one.
Disable is the safe default. It stops usage without losing binding metadata, and re-enabling is instant. Delete only when you are certain.
Clicking Test now on a credential card triggers a live probe against the provider’s API. For supported providers, the backend makes a real API call to verify the key is active and has access. For other providers, it performs structural and format validation.
200Response OK. Key is active and has the expected scopes.
valValidated 0 min ago: badge set on card.
Failure path: if the key is wrong, expired, or quota-blocked, the card shows an amber “Validation failed: {reason}” badge with the exact reason from the provider.
Success state
SendGrid, production
Validated 2 min ago
RenameRotateTest now
Failure state
Stripe, live
Validation failed: key revoked
RenameRotateTest now
Run Test now immediately after pasting a new API key, before you build anything on top of it. It catches copy-paste errors and expired keys in seconds, before a failed agent run makes the problem hard to diagnose.
When you rotate a credential in the vault, you change one encrypted value. Every agent, MCP server, skill, and channel that holds a binding picks up the new secret on their next invocation: silently, with no re-wiring. Watch the pulse propagate:
New value encrypted · SHA-256 hash updated · bindings intact
Picks up new key on next run
Resolves from vault on invocation
New value injected at connection time
Picks up new key on next run
Vault lookup at trigger time
Install MCP / configure skill
CredentialPicker appears
Already in the vault
Pick it from the list → reused
Not there yet
Paste a new value → saved
Credential bound
Agent / MCP uses it on run
The picker lists the active credentials in your vault so you can reuse one instead of pasting the same secret again. It surfaces the credential matching the slot’s provider and kind, and it may also list other active credentials, so read the provider slug before you select. Pasting a new value instead saves that value to your vault as a new credential.
Skill credentials · EVOLINK_API_KEY✕
Saved credential
Evolink key evolink · api_keySelected ✕
Bannerbear bannerbear · api_keyActive
Resolved from your vault when this skill runs.
Pick or paste, never both. The two paths are mutually exclusive. Selecting a saved credential removes the paste field entirely and replaces it with “Resolved from your vault when this skill runs.” Clear the selection and the paste field comes back. There is no precedence rule to remember, because you can only ever be doing one of the two.
How the vault pays off the moment a key changes, and how the delete guard keeps a live agent running.
”Rotated the SendGrid key at 9:02. All six consumers were on the new key by 9:03.”
Sam · Solo founder, after a scheduled key cycle
The same principle holds whether you are managing one workspace or twelve. Here is how the vault pays off in practice:
Omar · Agency owner
A client rotates their SendGrid key. Omar pastes the new value into the vault (one Rotate on the shared credential) and all twelve agents across that client’s workspace pick up the new key on their next run. Zero config sweeps, zero re-binding.
saves ~40 min per key cycle
Felix · Finance & Ops
Felix tries to delete an old Stripe credential. The Delete button is locked: the vault shows it still has two active bindings. He checks the bound consumers, migrates them to the new key, and only then does Delete unlock. The live reconciliation agent keeps running without interruption.
Delete or revoke a credential that a consumer was bound to and that binding is left pointing at nothing. The consumer will fail the next time it tries to resolve the secret. Fixing it means re-binding that consumer to a credential that exists; clearing the broken reference alone does not restore access.This is the failure mode the previous section warns about, and it is the reason to check the binding pill before deleting anything.
Needs re-auth
A credential in Needs re-auth status means the stored token needs to be re-authorized. The card shows the Needs re-auth badge and an explanatory note.
There is currently no Re-authenticate button on credentials in this state. The workaround: create a fresh credential for the same provider and use Rotate on any affected consumer bindings to point them at the new credential.
A credential can exist, be disabled, or be referenced by something that no longer resolves. These look similar in a list and behave very differently at run time.
What you see
What it means
What to do next
Credential listed, enabled
Saved and available to pick anywhere a secret is required.
Nothing. Use Test now if you want to confirm it still works at the provider.
Credential disabled
Still stored, but not offered in pickers and not usable by a run.
Re-enable it, or leave it disabled if you are pausing access deliberately.
A binding that cannot resolve
Something references a credential that has been deleted.
Clear the stale binding, pick a valid credential, and reconnect.
Needs re-auth on an OAuth connection
The provider revoked or expired the token.
Reconnect from the same place you first authorized. Do not delete and recreate.
The picker is empty
No saved credential matches what this field expects.
Create one first. A credential saved with the wrong kind or provider tag will not be offered here.
Why a credential you saved is not offered in a picker
Pickers filter by what the field needs. If a credential does not appear, it is usually saved under a different kind or provider than the field expects, or it is disabled. Open the vault and check both before creating a duplicate.
A save failed partway through
If validation rejects a field, the entry is not created. Nothing partial is stored and there is no orphaned record to clean up. Correct the field and save again.
Deletion is not guarded
Nothing stops you deleting a credential that is still in use. Anything bound to it fails at its next run, and the failure surfaces where that thing runs rather than in the vault. Check what references a credential before removing it.
Add shared credentials before installing multiple MCPs
If several MCP servers share the same API key, add the credential in the Credentials Vault first. It is then selectable from the picker in each install flow, so you paste the secret once and reuse it everywhere.
Use accurate provider tags
The Provider field is how the picker surfaces the right credential in the right slot. Tag credentials with the lowercase service identifier: sendgrid, github, slack, stripe. A wrong or vague tag means the picker will not auto-surface it.
Rotate, never delete and recreate
When a secret changes, use Rotate. Rotation preserves every binding. All consumers pick up the new value on next invocation, with no re-binding. Deleting and recreating requires manually re-binding every consumer.
Disable for temporary pauses, delete only when certain
Disable stops a credential from being used without losing its bindings. Re-enabling is instant. Reserve Delete for credentials you are certain you will never use again. It is irreversible.
Test now immediately after saving a new key
For supported providers, the backend makes a live API call to verify the key. Running Test now right after paste catches copy-paste errors and quota issues before an agent run fails.
Needs re-auth: create fresh and re-bind
There is no re-authenticate button for Needs re-auth credentials. The workaround: create a fresh credential for the same provider with Add credential, then re-bind consumers to it. Disable or delete the stale credential once all consumers are migrated.
