Skip to main content
Vault provides encrypted credential storage at the organization level. Use it to securely store API keys, tokens, and other secrets that your and integrations can reference at runtime.

​
Get started

1

Open organization settings

Click your organization name in the top left, then select Settings from the dropdown menu.
2

Select Vault

Click Vault in the left sidebar.
Vault requires the organization admin role. Organization members and guests cannot access or manage credentials.

​
Manage credentials

​
Create a credential

1

Open the create form

Click Add Credential on the Vault page.
2

Enter credential details

Provide a Name to identify the credential and the secret Value (API key, token, or password).
3

Save the credential

Click Save. The value is encrypted immediately and cannot be viewed again after creation.
A hint showing the first and last few characters of the value is displayed to help you identify credentials later.
Credential names must be unique within your organization.
Vault stores static values only. Ravenna does not fetch secrets at runtime from external secret managers such as AWS Secrets Manager, HashiCorp Vault, or Google Secret Manager. When a credential rotates, edit it in Ravenna to update the stored value.

​
Edit a credential

1

Find the credential

Navigate to Settings > Vault and locate the credential you want to update.
2

Open the edit form

Click the credential to open its details.
3

Update fields

Change the Name or enter a new Value. The previous value is never pre-filled for security reasons, so you must re-enter it if updating.
4

Save changes

Click Save to apply your changes.

​
Delete a credential

1

Find the credential

Navigate to Settings > Vault and locate the credential you want to delete.
2

Delete the credential

Click the delete option and confirm the deletion.
Deleting a credential may break workflows or integrations that reference it. Verify no active workflows use a credential before removing it.

​
Use credentials in workflows

Vault credentials are available in the HTTP Request workflow action. When configuring authentication, select a credential from the dropdown to securely provide the secret value.Supported authentication methods:
  • API Key - Select a vault credential for the API key value
  • Bearer Token - Select a vault credential for the bearer token value
  • Basic Auth - Select a vault credential for the password field
Credentials are decrypted only at runtime during workflow execution and are never exposed in the workflow builder or logs.
Learn more about the HTTP Request action and other workflow actions

​
Security

Vault credentials are protected with multiple layers of security:
  • Encryption at rest - Values are encrypted using AES-256-GCM envelope encryption
  • Write-only storage - Values are never returned by the API or displayed in the UI after creation
  • Organization-scoped isolation - Credentials are only accessible within the organization that created them
  • Admin-only access - Only organization admins can create, edit, or delete credentials
Last modified on August 11, 2026