The Vault

Where a Workspace keeps what its Reasons sign in with: website logins, password managers and secrets. What it stores, who can change it, and how agents use it.

The Vault holds everything Reasons sign in with. Open it at Settings > Vault. Items in the Vault are available to every Reason in the Workspace (Workspaces and sharing). Secret values and passwords are never shown again after you save them.

​

What it stores

Tab	Holds	How Reasons use it
Logins	A website’s https address, username, password and notes	The agent looks up the site and types the password into its sign-in page
Password managers	Connections to 1Password, Infisical, Bitwarden or Doppler	Connected as apps; Reasons use their tools to read items
Secrets	Named values such as API keys and tokens	Every cloud Session gets them as environment variables

The Vault does not store files. Files stay in the Library and on computers.

​

Logins

• Add one with New item, or import a CSV exported by 1Password, Chrome, Edge, Safari, Apple Passwords, Firefox, Bitwarden or LastPass. The file is read on your device and never uploaded; only the logins in it are saved. Up to 2,000 logins per import.
• Only https sites. Limits: username 512 characters, password 4,096, notes 2,000.
• People never see a saved password again. A Reason’s run reads it only to sign in, without asking, and every read is recorded in the audit log.

​

Secrets

• A secret is a name and a value. Names are up to 128 characters, values up to 64 KB.
• Values are write-only: nobody, including the API, can read one back.
• A secret can be brokered to listed hosts: the Session holds a placeholder, and Reason swaps in the real value only on requests to those hosts.
• When an agent needs a secret it doesn’t have, it asks with an Add secret card in the chat. The value reaches the running Session on its next turn.

​

Who can change it

Workspace owners and admins add, change and remove logins and secrets. Everyone in the Workspace can use them through their Reasons. Items saved before the Workspace owned its Vault appear under Previous setup, where an owner or admin can move them to the Workspace.

​

How it is protected

Values are encrypted with AES-256-GCM, using a key derived for each Workspace. They are decrypted only to hand a value to a run that needs it. Want secrets only you use? Keep them in a Workspace of your own.