Skip to main content
ZERO RE-WIRING

​
Your secrets. One vault. Every agent.

Paste a token once. Every agent, MCP server, skill, and channel that needs it picks it up automatically. Rotate the key from one screen and every consumer updates on the next invocation: no re-binding, no config sweeps.

The idea

​
What lives in the vault.

The Credentials Vault is the single place where Actionist stores every secret your agents need to reach the outside world. Everything in it renders as a credential card, whether you typed the value or an OAuth flow created it for you.

Secrets you paste

A raw secret you own and manage: an API key, personal access token, header secret, or client credentials pair. You paste the value, Actionist encrypts it, and the value is never shown again after save.

Secrets OAuth creates

Completing an OAuth consent screen produces a credential too. You never type a value; the install flow creates it. It appears as an ordinary card, identified by its provider and kind slug, for example gitlab · oauth_bundle.
The vault does not separate these into two labelled object types. OAuth-backed entries sit in the same list as everything else. The way to spot one is the oauth_bundle kind in its provider slug.

​
The four credential kinds

Long-lived key issued by a service. Examples: SendGrid, Stripe.

Short-lived or scoped bearer token, PAT, or bot token. Examples: GitHub PAT, Slack bot token.

A static secret sent as a custom HTTP header to an MCP or webhook endpoint.

OAuth 2.0 client ID + secret pair for server-to-server flows.

Try it · lifecycle

​
Reading a credential card.

Each card shows a color-coded key medallion, display name, status badge, binding-count pill, provider/kind slug, and relative last-updated time. Five action buttons appear on every card: Rename, Rotate, Test now, Disable / Enable, and Delete. Which ones are usable shifts with the credential’s state. Pick a state:

SendGrid · productionsendgrid · api-key6 bindings
ActiveInvalidDisabledNeeds re-auth
RenameRotateTest nowDisableDelete
RenameRotateTest nowDisableDelete
RenameRotateEnableDelete
RenameRotateDisableDelete
Active: available for new and existing bindings. All five actions are available, including Delete.
Invalid: the backend determined the secret is no longer valid (expired, revoked, or quota-blocked). Run Test now to see the failure reason, then Rotate with a fresh value to restore it. All bindings remain intact while you rotate.
Disabled: paused manually. Cannot be selected in new bindings, but all binding metadata is preserved. Rotate is locked: re-enable the credential first, then rotate the value. Click Enable to restore instantly.
Needs re-auth: the stored token requires re-authorization. There is no Re-authenticate button. Workaround: create a fresh credential for the same provider with Add credential, then re-bind every consumer to it. Disable or delete the stale credential once migrated.
The value field reads “Saved encrypted; never shown after save.” This is by design. To update a saved secret, use Rotate: not delete-and-recreate.
The page

​
Open the vault.

Go to Settings and expand the Credentials Vault panel. It is a card on the Settings page rather than a separate tab, so nothing is visible until you expand it. Once open you get the stored and binding counts, a Search credentials field, Refresh, Add credential, and the credential cards themselves.

4 credentials stored
6 active bindings
Search credentials…RefreshAdd credential
SendGrid · productionsendgrid · api-key3 bindings
Active
RenameRotateTest nowDisableDelete
GitHub PAT · workgithub · token0 bindings
Disabled
RenameRotateEnableDelete
Stripe · livestripe · api-key2 bindings
Invalid
RenameRotateTest nowDisableDelete
Most users find the vault nearly empty at first. When you paste a token while installing an MCP or configuring an agent’s bot channel, Actionist saves it automatically. Use the vault to manage what has already been saved, or to add credentials you want available before you start building.
4 credentials stored6 active bindings
Search credentials…RefreshAdd credential
SendGrid · productionsendgrid · api-key3 bindings
Active
GitHub PAT · workgithub · token0 bindings
Disabled
Stripe · livestripe · api-key2 bindings
Invalid
Lifecycle

​
The full credential lifecycle.

From first save to eventual deletion. Every action you can take on a credential, and exactly how each one works.

​
Add a credential

Click Add credential in the toolbar and an inline form expands. Three fields are required: Display name (for example GitHub PAT - work), Provider (lowercase identifier: github, sendgrid, slack), and Value (password-masked). Submitting an empty form tells you exactly that: “Display name, provider, and value are required.”Kind is a dropdown that defaults to API key, so you never have to touch it, but change it when the secret is a token, header secret, or client credentials pair. Click Save credential and it appears with an Active badge immediately.

​
Everything else you can do

Click Rename. The display name becomes an inline input. Press Enter to save or Escape to cancel. Provider tag and kind are unchanged. All bound consumers keep working.
Rotate replaces the stored secret while keeping every binding intact. The next time any bound consumer runs, it picks up the new value automatically, no re-wiring needed.Click Rotate, paste the new secret in the New value field, and press Enter. The banner confirms: “Existing bindings keep working — they pick up the new value on next use.”
Rotation is the only way to update a saved secret. You cannot rotate a disabled credential, re-enable it first.
SendGrid, productionActive
New value
••••••••••••••••••••••••Show
Existing bindings keep working. They pick up the new value on next use.
SaveCancel
Click Disable. The status changes to Disabled and the button becomes Enable (green). Disabled credentials cannot be selected in new bindings, but all binding metadata is preserved. Click Enable to restore, instant and reversible.
Prefer Disable over Delete for temporary pauses. Re-enabling is instant; deleting requires re-binding every consumer.
Click Delete and confirm. The credential is permanently removed.
Nothing stops you deleting a credential that is still in use. There is no binding check and no confirmation that counts consumers for you. If an agent, MCP, skill, channel, or workflow is bound to the credential you delete, it breaks the next time it runs.Check the binding-count pill on the card before you delete, and migrate those consumers to another credential first. When in doubt, use Disable: it stops the credential being used, keeps the binding metadata, and is instantly reversible.
Care required

​
Deletion is not guarded. Check first.

The binding-count pill on each card tells you how many consumers depend on that credential, but nothing enforces it. A credential with active bindings deletes exactly as readily as one with none.

Read the binding pill. If it says anything other than 0 bindings, something is depending on this credential right now.
Migrate, then delete. Point each bound agent, MCP, skill, channel, or workflow at the replacement credential before you remove the old one.
Disable is the safe default. It stops usage without losing binding metadata, and re-enabling is instant. Delete only when you are certain.
Validation

​
Test a key before an agent does.

Clicking Test now on a credential card triggers a live probe against the provider’s API. For supported providers, the backend makes a real API call to verify the key is active and has access. For other providers, it performs structural and format validation.

test · SendGrid · production
reqGET api.sendgrid.com/v3/scopes, checking key scope…
200Response OK. Key is active and has the expected scopes.
valValidated 0 min ago: badge set on card.
Failure path: if the key is wrong, expired, or quota-blocked, the card shows an amber “Validation failed: {reason}” badge with the exact reason from the provider.
Success state
SendGrid, production
Validated 2 min ago
RenameRotateTest now
Failure state
Stripe, live
Validation failed: key revoked
RenameRotateTest now
Run Test now immediately after pasting a new API key, before you build anything on top of it. It catches copy-paste errors and expired keys in seconds, before a failed agent run makes the problem hard to diagnose.
How it flows

​
Rotate once. Every consumer updates.

When you rotate a credential in the vault, you change one encrypted value. Every agent, MCP server, skill, and channel that holds a binding picks up the new secret on their next invocation: silently, with no re-wiring. Watch the pulse propagate:

New value encrypted · SHA-256 hash updated · bindings intact
Picks up new key on next run
Resolves from vault on invocation
New value injected at connection time
Picks up new key on next run
Vault lookup at trigger time
Install MCP / configure skill
CredentialPicker appears
Already in the vault
Pick it from the list → reused
Not there yet
Paste a new value → saved
Credential bound
Agent / MCP uses it on run

The picker lists the active credentials in your vault so you can reuse one instead of pasting the same secret again. It surfaces the credential matching the slot’s provider and kind, and it may also list other active credentials, so read the provider slug before you select. Pasting a new value instead saves that value to your vault as a new credential.

Skill credentials · EVOLINK_API_KEY✕
Saved credential
Evolink key evolink · api_keySelected ✕
Bannerbear bannerbear · api_keyActive
Resolved from your vault when this skill runs.
Pick or paste, never both. The two paths are mutually exclusive. Selecting a saved credential removes the paste field entirely and replaces it with “Resolved from your vault when this skill runs.” Clear the selection and the paste field comes back. There is no precedence rule to remember, because you can only ever be doing one of the two.
In practice

​
One rotation, instant everywhere.

How the vault pays off the moment a key changes, and how the delete guard keeps a live agent running.

”Rotated the SendGrid key at 9:02. All six consumers were on the new key by 9:03.”

Sam · Solo founder, after a scheduled key cycle

The same principle holds whether you are managing one workspace or twelve. Here is how the vault pays off in practice:

Omar · Agency owner
A client rotates their SendGrid key. Omar pastes the new value into the vault (one Rotate on the shared credential) and all twelve agents across that client’s workspace pick up the new key on their next run. Zero config sweeps, zero re-binding.
saves ~40 min per key cycle
Felix · Finance & Ops
Felix tries to delete an old Stripe credential. The Delete button is locked: the vault shows it still has two active bindings. He checks the bound consumers, migrates them to the new key, and only then does Delete unlock. The live reconciliation agent keeps running without interruption.
one broken agent avoided
Edge cases

​
Stale bindings and Needs re-auth.

Delete or revoke a credential that a consumer was bound to and that binding is left pointing at nothing. The consumer will fail the next time it tries to resolve the secret. Fixing it means re-binding that consumer to a credential that exists; clearing the broken reference alone does not restore access.This is the failure mode the previous section warns about, and it is the reason to check the binding pill before deleting anything.
A credential in Needs re-auth status means the stored token needs to be re-authorized. The card shows the Needs re-auth badge and an explanatory note.
There is currently no Re-authenticate button on credentials in this state. The workaround: create a fresh credential for the same provider and use Rotate on any affected consumer bindings to point them at the new credential.
States and controls

​
Reading credential state.

A credential can exist, be disabled, or be referenced by something that no longer resolves. These look similar in a list and behave very differently at run time.

Why a credential you saved is not offered in a picker

Pickers filter by what the field needs. If a credential does not appear, it is usually saved under a different kind or provider than the field expects, or it is disabled. Open the vault and check both before creating a duplicate.
If validation rejects a field, the entry is not created. Nothing partial is stored and there is no orphaned record to clean up. Correct the field and save again.
Nothing stops you deleting a credential that is still in use. Anything bound to it fails at its next run, and the failure surfaces where that thing runs rather than in the vault. Check what references a credential before removing it.
Best practices

​
Get the most out of the vault.

If several MCP servers share the same API key, add the credential in the Credentials Vault first. It is then selectable from the picker in each install flow, so you paste the secret once and reuse it everywhere.
The Provider field is how the picker surfaces the right credential in the right slot. Tag credentials with the lowercase service identifier: sendgrid, github, slack, stripe. A wrong or vague tag means the picker will not auto-surface it.
When a secret changes, use Rotate. Rotation preserves every binding. All consumers pick up the new value on next invocation, with no re-binding. Deleting and recreating requires manually re-binding every consumer.
Disable stops a credential from being used without losing its bindings. Re-enabling is instant. Reserve Delete for credentials you are certain you will never use again. It is irreversible.
For supported providers, the backend makes a live API call to verify the key. Running Test now right after paste catches copy-paste errors and quota issues before an agent run fails.
There is no re-authenticate button for Needs re-auth credentials. The workaround: create a fresh credential for the same provider with Add credential, then re-bind consumers to it. Disable or delete the stale credential once all consumers are migrated.
Always in sync

​
One vault. Zero re-wiring.

Add a credential once. Rotate from one screen. Every consumer stays in sync on the next invocation: agents, MCPs, skills, and channels.

Open the DashboardEmail the team

Encrypted at rest · Never shown after save · Scoped to your workspace.
Add, rename, rotate, test, disable, and delete: all of it works in the web app.

Keep going

​
Next steps.

MCP servers

Install MCP servers for Slack, Notion, Linear, and more. The CredentialPicker handles binding automatically during setup.

Skills

Wire credentials to skill slots so every agent that loads a skill picks up the right secret automatically.

Channels

Telegram and Slack bot tokens are stored in the vault. Set up a channel and your bot token stays encrypted.

Cloud runtime

Run agents unattended, and see how they resolve the same vault credentials when nobody is watching.