Full reference
Workspace Vault
Store named secrets for managed tasks, rotate them without changing task source, and inspect metadata without reading secret values back.
Updated
Reviewed against Console v0.2.2. Available actions depend on project access and runtime configuration; check your installed CLI version for command differences.
Find secret management in Console
Open Settings → Organisation → Vault. Review which runtime or integration consumes a secret before changing it. Project inference keys remain under Settings → Project → API keys; they are a different credential surface.
Choose Vault for task secrets
Vault holds workspace-scoped named secrets used by managed execution. Use BYOK for upstream inference-provider credentials and API keys for application access to Stimulir. These are separate credential lifecycles.
Set or rotate a secret
Open Vault in the intended Console workspace, choose Set secret, and enter its name and value. Setting the same name replaces its value. Use a name the skill expects, then verify the save result without printing the value.
Review the allowed projects when setting a secret. A project restriction limits which projects may use it; an unrestricted secret is available across the workspace. Keep the scope no broader than the task needs.
Inspect metadata
Listings show the key name, whether a value exists, and timestamps. Saved secret values are not returned by the read path. There is no Vault CLI command in this reference.
| Operation | Platform route |
|---|---|
| List metadata | GET /api/v1/workspace/secrets |
| Set or rotate | PUT /api/v1/workspace/secrets |
| Delete a key | DELETE /api/v1/workspace/secrets/{key} |
These account-authorized routes require the target business_profile_id. The write body also contains key and value. Prefer the Console form over copying a session token into a shell command.
Remove an unused secret
Confirm that active tasks no longer require the key before deleting it. Removing a Vault value does not revoke the original credential at its provider; revoke there too when retiring or responding to exposure.
Read the value only inside the task
Managed execution makes workspace Vault values available to its sandbox environment. The skill should read only what it needs and report a missing required key clearly. Review imported code because it can access supplied secrets. Never include secret values in task output or debug logs.