Vault Tool — Secrets Management

What is it?

The Vault is Yukkai's built-in secure secrets manager. It stores your sensitive credentials — API keys, access tokens, passwords — in an encrypted store and lets Yukkai use them without ever revealing the actual values in your conversation.

Think of it like a digital safe: Yukkai can use a key inside the safe to unlock a door, but it never takes the key out where anyone can see it. This means you get the convenience of automated, authenticated actions without the risk of accidentally leaking secrets in chat history.

How it works

The Vault operates on a simple but powerful principle: secret values are never returned in clear text. When Yukkai needs to use a credential, it retrieves a secure placeholder (like {{VAULT:openrouter}}) rather than the real value. That placeholder is only resolved at the very moment a request is sent — and only on your device, behind the scenes.

Here's the flow at a glance:

1. You store a credential (e.g., your OpenRouter API key) in the Vault.
2. Yukkai retrieves a placeholder — not the key itself.
3. When an authenticated action is needed, Yukkai makes the request with the real key injected client-side, so the secret never appears in conversation or logs.
4. You can see which services are stored at any time via the list action — but never their values.

Predefined services

The Vault ships with built-in support for these common services:

Service	Description
openrouter	OpenRouter API key for model routing
github	GitHub personal access token
openai	OpenAI API key
anthropic	Anthropic API key
parse	Parse / Symbyoz Cloud Code credentials
brave	Brave Search API key
apify	Apify API token

You can also add your own custom services as needed.

How to use it

The Vault provides four actions you can ask Yukkai to perform:

1. List stored services

See which services have credentials stored — without revealing any values:

"Show me what services are in my Vault"

This returns service names and labels only, never the secret itself.

2. Get a secure placeholder

Retrieve a placeholder you can safely reference in workflows, commands, or automation:

"Get the placeholder for my OpenRouter key"

Returns something like:

{{VAULT:openrouter}}

This placeholder can be used in shell commands, API calls, or workflow definitions without ever exposing the real key.

3. Get additional fields

Some services store extra metadata beyond the main secret — such as a URL, app ID, or client key. You can retrieve those fields separately:

"Get the URL field for my Parse service"

This is useful when a service requires both an endpoint URL and an authentication key.

4. Make an authenticated API call

The most powerful action: ask Yukkai to execute an HTTP request with the secret automatically injected — without the key ever appearing in the conversation:

"Call the OpenRouter API to check my key usage"

Yukkai will:

• Select the right service from the Vault
• Build the request (method, URL, headers, body)
• Inject the secret client-side at execution time
• Return only the response — never the key

Supported HTTP methods: GET, POST, PUT, DELETE.

Examples

Example: Check API key usage

"Use the vault to call OpenRouter and tell me my remaining credits"

Yukkai makes an authenticated GET request to OpenRouter's usage endpoint using your stored key — and reports back your remaining balance. The key itself never appears in the conversation.

Example: Use a placeholder in a shell command

"Run curl https://api.example.com/data -H 'Authorization: Bearer {{VAULT:openrouter}}'"

The placeholder {{VAULT:openrouter}} is resolved silently when the command executes, so the real key is used without being printed.

Example: List all stored services

"What services do I have stored in the Vault?"

Returns something like:

Available services:
- openrouter (API Key)
- github (Personal Access Token)
- brave (Search API Key)

Example: Retrieve a custom field

"Get the appId field for my Parse service"

This fetches just the appId metadata — useful for configuration without exposing the main secret.

Tips & best practices

• Never paste secrets into chat. If you need to add a new key, do it through Yukkai's settings or a secure setup flow — never type the raw key value into a conversation.
• Use api_call instead of manual requests. When Yukkai needs to make an authenticated request, prefer the Vault's api_call action over constructing the request manually. This guarantees the secret stays hidden.
• List regularly. Periodically ask Yukkai to list your stored services so you know what's in your Vault. Remove any credentials you no longer use.
• Placeholders are safe to share. Text like {{VAULT:openrouter}} contains no secret data — it's just a reference. You can safely include placeholders in workflows, scripts, or saved configurations.
• Rotate your keys. If a credential may have been compromised (e.g., you typed it somewhere by accident), rotate it at the provider and update the Vault — don't try to "unsee" it.
• One service, one purpose. Store each credential under its correct service name so Yukkai can automatically select the right key for the right task.
• Custom services are supported. If you have a credential that doesn't match a predefined service, you can still store it — just give it a clear, unique name.

🔒 Security note: The Vault is designed so that secret values are never exposed to the AI model processing your conversation. Secrets are resolved only at execution time, locally on your device. This is a core part of Yukkai's privacy architecture.