Vault
Keep third-party credentials for agents.
Vault keeps the credentials agents need to call third-party services, such as a GitHub token, an OpenAI API key or a Linear authorization. Each vault is a set of secrets; one secret is one credential.
Secrets are write-only: once written, no endpoint returns the value again. Every secret carries a list of allowed hosts, and only requests to those hosts can use it. Agents and tools reference secrets by name, for example GITHUB_TOKEN.
- Quickstart: create a vault, add a secret, then list it.
- Concepts: secret kinds, templates, import, authorization and refresh.
- Limits and errors: capacity limits and error handling.
API reference → · Claude Managed Agents vaults → · Cookbook →