How-to · Lesson 3 of 19
Secrets Management: Vault-Backed, Write-Only Keys
An API key pasted into a workflow travels wherever the workflow goes. Save it once into the vault instead, and from then on MagOneAI only ever shows a masked preview while workflows use it without seeing it.
What You Will Learn
- Where secrets are entered: tool connections, LLM config API keys, OAuth app credentials and external MCP server headers
- Why secrets are stored in HashiCorp Vault, separate from the application database
- Write-only after save: the interface and the API return a masked preview, never the plaintext
- Changing a secret by entering a new value, because the old one cannot be read back
- Connection scope: personal, project or organization, and why the most specific one wins at run time
- Referencing a vault secret from an API node instead of pasting a token into a header
- Project API keys for triggering workflows: shown once when created, then never again