> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault providers

> Where credentials live, how to attach your own vault, and where xpander's keys sit on a self-hosted cluster.

An agent references a credential by name. xpander injects the value at the moment of use, so nothing in the agent's prompt, files or record holds it.

![Diagram](https://docs.xpander.ai/images/diagrams/run-integrations-vault-0a5b5144.svg)

## The Vault

**Platform > Agents > Secrets** (admins) holds every credential in the workspace: environment secrets, environment files and credentials shared across the organization. Each one is usable by **Everyone**, **Groups and people** or **Owner only**. Agents get values as environment variables and never see the Vault. Secrets scoped to one agent and each person's own connections are covered on [Credentials](https://docs.xpander.ai/use/agents/credentials.md).

### Add a secret

Names are saved in uppercase letters and underscores, and agents read them under that name or an optional variable name. Names xpander reserves are refused. The value is never shown again after saving.

![Add secret panel with Secret name, Type (API key or token, Multi-line text), Value, Who can use it (Everyone, Groups and people, Owner only) and Variable name](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/vault-create-secret-1.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=851bed4f4567e3a42e933eef870c66fd)

Add secret: name, type, value, who can use it and an optional variable name. Shown with sample data.

## An external vault

**Storage locations** > **Attach vault** connects a vault your organization already runs. xpander imports secret **names** only. The values stay in your vault, and `${ext:NAME}` pulls a value when the workspace starts.

Supported today: **Azure Key Vault**. You need its vault URL, tenant ID, and the client ID and secret of a service principal with `Get` and `List` secret permissions. After you rotate that secret, use **Update credential**. **Refresh secret names** re-imports names. **Detach vault** removes the names without touching the values.

![Attach Azure Key Vault panel with Vault URL, Tenant ID, Client ID, Client secret, Credential expires on, Display name and Use this vault for new secrets, filled with sample values](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/vault-azure-form-1.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=07e0051f547e9d665332dacc15f6c90a)

Attach Azure Key Vault: vault URL, tenant ID, client ID and secret, optional expiry and display name, and whether new secrets go to this vault. Shown with sample data.

## xpander's keys on a self-hosted cluster

Provider keys and xpander's own secrets are Kubernetes secrets in the release namespace:

| Secret | How it is set |
| - | - |
| `xpander-static` | From chart values `secrets.static.*`. See [Hybrid: managing LLM API keys](https://docs.xpander.ai/self-hosted/hybrid.md#managing-llm-api-keys). |
| A secret you manage | Referenced with `envFromSecretKeys` on the service that needs it |
| `xpander-generated-keys` | Generated bootstrap values. `keygen.overrides.<NAME>` wins, for example a password you set on an external database. |

Skill credentials, connector OAuth tokens and IAM session credentials stay in your cluster. The skill relay injects them at call time. Per-person MCP sign-in tokens stay in your cluster on Air-Gapped. On Hybrid they live in xpander Cloud's vault and are fetched at run time ([details](https://docs.xpander.ai/resources/security-compliance/security-architecture-hybrid.md#per-person-mcp-sign-in-tokens)). Skills that reach AWS can use [AWS Secrets Manager](https://docs.xpander.ai/self-hosted/aws-operator.md#credential-management-with-aws-secrets-manager).

## Next steps

> **[Understand how agents use credentials](https://docs.xpander.ai/use/agents/credentials.md)**
>
> Vault, workspace secrets, connections

> **[Manage LLM API keys on Hybrid](https://docs.xpander.ai/self-hosted/hybrid.md#managing-llm-api-keys)**
>
> Chart values to secrets


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.