Vault

Store API keys, tokens, and secrets in the encrypted organization Vault and reference them securely from Ravenna workflows and integrations.

Vault provides encrypted credential storage at the organization level. Use it to securely store API keys, tokens, and other secrets that your workflows and integrations can reference at runtime.

---

Get started

1. Open organization settings

   Click your organization name in the top left, then select Settings from the dropdown menu.

2. Select Vault

   Click Vault in the left sidebar.

Vault requires the organization admin role. Organization members and guests cannot access or manage credentials.

---

Manage credentials

Create a credential

1. Open the create form

   Click Add Credential on the Vault page.

2. Enter credential details

   Provide a Name to identify the credential and the secret Value (API key, token, or password).

3. Save the credential

   Click Save. The value is encrypted immediately and cannot be viewed again after creation.

A hint showing the first and last few characters of the value is displayed to help you identify credentials later.

Credential names must be unique within your organization.

Edit a credential

1. Find the credential

   Navigate to Settings > Vault and locate the credential you want to update.

2. Open the edit form

   Click the credential to open its details.

3. Update fields

   Change the Name or enter a new Value. The previous value is never pre-filled for security reasons, so you must re-enter it if updating.

4. Save changes

   Click Save to apply your changes.

Delete a credential

1. Find the credential

   Navigate to Settings > Vault and locate the credential you want to delete.

2. Delete the credential

   Click the delete option and confirm the deletion.

Deleting a credential may break workflows or integrations that reference it. Verify no active workflows use a credential before removing it.

---

Use credentials in workflows

Vault credentials are available in the HTTP Request workflow action. When configuring authentication, select a credential from the dropdown to securely provide the secret value.

Supported authentication methods:

• API Key - Select a vault credential for the API key value
• Bearer Token - Select a vault credential for the bearer token value
• Basic Auth - Select a vault credential for the password field

Credentials are decrypted only at runtime during workflow execution and are never exposed in the workflow builder or logs.

Learn more about the HTTP Request action and other workflow actions

---

Security

Vault credentials are protected with multiple layers of security:

• Encryption at rest - Values are encrypted using AES-256-GCM envelope encryption
• Write-only storage - Values are never returned by the API or displayed in the UI after creation
• Organization-scoped isolation - Credentials are only accessible within the organization that created them
• Admin-only access - Only organization admins can create, edit, or delete credentials