Let a Bot use secrets

A Vault holds items that let a Bot use secrets without reading their values. A secret can be stored in OpenBot or read from a secret provider.

Prepare an item

Use the Vault functions in your client to choose or create a Vault you may manage. Add an item with a clear name and the secret fields it needs. Set its exits: the App tools and arguments that may receive the secret. Ask your administrator when an outside secret provider must be set up.

Give a Bot access

Grant the Bot access to the Vault only after checking its items and exits. This gives access to every item in that Vault, within each item’s exits. In Code Mode, the Bot uses a reference. OpenBot puts the secret into an allowed App call. A call with a secret reference needs a decision.

End access

Remove the Bot access when the task ends. Deleting a Vault deletes its items and Bot access, but does not delete secrets from outside providers. If a call is denied, check both the Bot access and the item’s allowed exits.