VyroAI

Loading...

Secret Vault

The Secret Vault stops a message holding an API key, bot token or password before it reaches the AI. What it spots on its own, and what you add by hand.

The problem it solves

It is easy to paste a database password or a bot token into a chat message without thinking. Messages are handled by outside AI providers and can end up in their logs, so once it is sent it is out of your hands. The Secret Vault is there to catch it on the way out.

Two layers, and one of them needs no setting up

Everything you send from AI Chat or from a project chat is checked before it leaves:

What happens when it catches one

The message does not go. A dialog appears — API key detected in your message — listing what it found, each one masked to its first and last four characters. Three ways out:

A secret already in your vault is taken out without asking

That dialog is for something the scanner recognises in a message. A secret you have already stored on the server — the Vault tab of Memory & Vault — takes a quieter path in a project chat inside the Code Studio. The message is sent, the secret is swapped for [REDACTED] on the way to the AI, and the only sign of it is a small note in the corner reading "A stored secret was detected and removed from your message before sending to AI."

There is no dialog and nothing to confirm, so it is easy to miss — and your own chat bubble still shows the secret exactly as you typed it. That bubble is your copy, not what was sent. The match is on the exact text, so a secret you pasted in a slightly different form goes through as it is.

Adding one

The vault is in Profile → API keys, below the API keys card. Give the secret a label you will recognise in the warning and paste the value; it needs at least six characters, and the same value cannot be added twice. Everything in the list is shown masked, with a Move to vault button and a bin icon to remove it.

Kept in this browser, until you move it

Secrets you add here are stored in this browser. They are not uploaded, synced or sent to VyroAI while they stay here. That is also the limitation: they do not follow you to another computer, another browser or a private window, and clearing your browser data clears them.

Each saved secret has a Move to vault button, and pressing it is how a secret leaves your browser. The secret is then saved on VyroAI's servers for all your projects, in the Vault tab of Memory & Vault, and removed from this browser. The AI never gets the value of a key in that vault, but it does see the key's name. See Project Memory.

Until the server vault is switched on, the button stays greyed out and the card says "Move to vault switches on with the next server update." The built-in key shapes above keep working everywhere regardless.

The match is on the exact text, so add a secret in the form you actually paste it. A token you always paste with Bearer in front of it is worth adding both ways.

Where to next

7 of 7 in Power User · Last checked 17 September 2026 · Previous: API Keys & Public API