# The Vault and secrets

> API keys and credentials stay out of your code and out of the AI's sight. How secrets work in Vaulter.

Some features need a credential to work, like an API key for a service your app talks to. Vaulter keeps those out of your code, and out of the AI's sight.

## Why secrets never go in code

A secret like an API key should never be written directly into your app's code. If it were, anyone who could see the code could use it. In Vaulter, secrets live outside the code: your app can use them at runtime, but they are not exposed in the source or to your visitors.

## The two kinds of credentials

**Connected services.** For the third-party services in the [connector catalog](/docs/integrations/catalog), you do not handle raw keys at all. You connect the service once, through its own sign-in or key form, and the credential is held by Vaulter's secure connection layer, never written into your project files. Your app then talks to the service through Vaulter, which attaches the credential server-side on every call.

**Your own keys.** For anything else, the agent asks you for the key at the exact moment it is needed. If you ask for a feature that calls an outside service, the agent pauses the build and shows a **Set in Vault** button naming the key it needs and why. You paste the value, and the build resumes. The key is stored under a clear name in capitals, like `WEATHER_API_KEY`.

## The agent never sees your values

This is worth knowing: the agent can check **whether** a secret is set, by name, but it can never read the value. Not in chat, not while building. So even mid-conversation, your keys stay yours.

## What Vaulter sets for you

Your app's own plumbing, like its database address and its app identity, is stamped into the app's environment automatically on every build. You never manage those, and when platform keys rotate, every app picks up the new ones on its next build without you doing anything.

> Treat this as the one rule: if you are ever about to paste a key into a chat message or into the code editor, stop, and put it in the Vault instead. The agent will use it by name.