Secrets Vault

The Secrets Vault is a secure, personal store for sensitive values — API keys, access tokens, and other credentials — that your agents need when calling external APIs. Secrets are encrypted at rest, and once saved, their values are never displayed again: not in the UI, not in run output, and not to anyone you share an agent with.

Managing your secrets

Open Settings > Secrets Vault (or go directly to app.kindo.ai/?settings=secrets-vault). Every Kindo user has a personal vault; secrets are owned by you, not shared across your organization.

From the vault you can:

• Add a secret — give it a label (unique within your vault) and paste the value. The input is masked as you type, with a toggle to reveal it before saving.
• Rename a secret — edit the label inline. The stored value is unchanged.
• Delete a secret — if the secret is referenced by any agent API Action Steps, the confirmation dialog lists each affected agent with a link to it. Deleting removes the referencing header and parameter fields from those steps.

Secrets are write-only: there is no way to view a stored value after saving it. To change a secret’s value, delete it and create a new one, then re-select it in the steps that used it.

Using secrets in agents

Secrets are consumed by API Action Steps in the agent builder. When configuring a request header or query parameter, choose Secret as the value type and pick one of your secrets from the dropdown.

Common uses:

• Authentication headers — select a scheme (Bearer or Basic) and a secret, and Kindo builds the Authorization header for you.
• Custom headers — for example, an X-API-Key header whose value is a secret.
• Query parameters — for APIs that pass credentials as URL parameters.

Secrets can be used in headers and query parameters only. The endpoint URL and request body accept text or dynamic values, not secrets.

At run time, Kindo decrypts the secret and sends it with the request. Everywhere the request is shown — run history, step output visible to the model, and audit logs — the value is replaced with the literal text SECRET, so a header renders as Authorization: Bearer SECRET.

Secrets and shared agents

When you share an agent that uses your secrets:

• Users you share it with can run the agent, and their runs use your secrets — but they can never view the values or edit the API Action Steps. In the builder, they see a CREATOR'S SECRET placeholder instead of your secret’s label.
• When someone duplicates your agent, your secrets are not copied. The duplicated steps contain a [SECRET_PLACEHOLDER] marker, and the builder shows a warning on each affected step until the new owner replaces the placeholders with secrets from their own vault.

Before sharing an agent that references secrets, Kindo shows a confirmation summarizing exactly this behavior.

Auditing

Creating, renaming, and deleting a secret each produce an audit log event that records the secret’s label — never its value. API requests made by agents appear in the audit log with secret values redacted.