Setting up a secret — Wundervault

Every value is encrypted in your browser before it is saved. Our server cannot read it. Once every computer on your account runs the updated broker, names and setups are locked away from our server too.

Add a secret

Go to Vault → Add a secret. Start with the one box labelled What is this key for?

Type a known service and press Enter. The form fills in that service's own labels, how the key is sent, and where it may go. You only paste the values.

The service list is a shortcut, not a restriction. Everything it fills in can be changed with Change how it's sent. Check where the key may go before saving.

For an unknown service, type its name and press Add “<name>”. Choose what kind of key it is, then how it is sent.

Choose the kind of key

One API key or token — one value supplied by a service.
ID and secret — two values that the service needs together.
Four keys for signed requests — four values used to sign requests, as X requires.
Username and password — a pair sent as a username and password.
Website login (stored only) — a website login kept for storage only.
SSH key — a private key used to sign in to servers.
Crypto wallet — a key for a Base or Solana wallet.
Signing key — a key used to sign data.

Choose how a web key is sent

Match the example in the service's own instructions. The choices are:

Authorization: Bearer <secret> (most services) — the key follows Bearer in the Authorization header.
In a header the service names, like x-api-key: <secret> — use the header name the service gives you.
After ? in the web address, like ?api_key=<secret> — the key goes in a named part after the question mark.
Inside the web address, like /bot<secret>/sendMessage — the key goes between the pieces of address the service specifies.
As a username and password — the two values are sent together as a login.
Signed requests — the key signs each request rather than being pasted into it.

For ID and secret, each part gets its own row. Set where it goes, its header name if needed, and any text around it. There are at most two rows.

A key in the web address may not contain spaces, ?, #, or %. It may not start or end with /.

A service that isn't on the list, field by field

Have the service's own instructions open. They show an example request; copy its shape.

Name: what you'll call it. Your agents see this name.
Kind: see the list above. Most services give One API key or token.
Send it as: pick the choice whose example looks like the service's. - A header with its own name: type the header name exactly, for example X-Access. If the service wants text before the key, put it in Text before, for example Token (with the space) for X-Access: Token <key>. - After ? in the address: type the parameter name, for example api_key. - Inside the address: type the address path with {secret} where the key goes, for example /bot{secret}. Your agent adds the rest of the path. - Username and password: type the username; the key is the password.
ID and secret: one row per part. Each row has Where, Name, Text before, Which part and Text after. Two headers is the usual case.
Where it may go: for a service on the list, its addresses are filled in. For any other service, the first time an agent uses the key at a new address you are told about it (Runs without asking) or asked first (Asks me first).

Signed requests

Some services never take the key itself: each request carries a code made from it instead. Choose Signed requests for those. Supported today:

OAuth 1.0a, for X. Use the Four keys for signed requests kind.
AWS Signature Version 4, for AWS. Use ID and secret (the access key ID and the secret access key), then under Change how it's sent choose Signed requests (AWS, exchanges).
HMAC signing, which many exchanges use. Use ID and secret the same way, or One API key or token with Signed requests if the service gives you only a secret. Your agent describes how the service wants each request signed, and you approve each new way once.

Keys that sign tokens (JWT) are not supported yet. A service that needs one can't be set up yet.

Choose approval

Choose Runs without asking or Asks me first. Asks me first needs a passkey.

Agents on a computer whose broker has not been updated cannot receive keys with several parts. The vault says Update <computer> first. Update that computer's broker before using the key there.

Services that fill in the form

Each line says what to paste, how it is sent, and where to find the service's instructions.

Airtable — paste Personal access token; sent as a Bearer token. Help
Alpaca — paste Key ID and Secret key; sent in the apca-api-key-id header and in the apca-api-secret-key header. Help
Anthropic — paste API key; sent in the x-api-key header. Help
Brave Search — paste API key; sent in the x-subscription-token header. Help
Cloudflare (API token) — paste API token; sent as a Bearer token. Help
Cloudflare (global API key) — paste Account email and Global API key; sent in the x-auth-email header and in the x-auth-key header. Help
Discord webhook — paste Webhook ID and token (after /api/webhooks/); sent in the web address. Help
ElevenLabs — paste API key; sent in the xi-api-key header. Help
GitHub — paste Personal access token; sent as a Bearer token. Help
GitLab — paste Personal access token; sent in the private-token header. Help
Google Gemini — paste API key; sent in the x-goog-api-key header. Help
Groq — paste API key; sent as a Bearer token. Help
Linear — paste Personal API key; sent in the authorization header. Help
Listmonk — paste API user and Token; sent as a username and password. Help
Mistral — paste API key; sent as a Bearer token. Help
Notion — paste Integration secret; sent as a Bearer token. Help
OpenAI — paste API key; sent as a Bearer token. Help
OpenRouter — paste API key; sent as a Bearer token. Help
Postmark — paste Server token; sent in the x-postmark-server-token header. Help
Resend — paste API key; sent as a Bearer token. Help
SendGrid — paste API key; sent as a Bearer token. Help
Slack webhook — paste Webhook path (after /services/); sent in the web address. Help
Stripe — paste Secret key; sent as a Bearer token. Help
Tavily — paste API key; sent as a Bearer token. Help
Telegram bot — paste Bot token; sent in the web address. Help
Twilio — paste Account SID and Auth token; sent as a username and password. Help
X (Twitter) — paste API key and API key secret and Access token and Access token secret; sent as signed requests (OAuth 1.0a). Help

Worked examples

OpenAI: Type OpenAI and press Enter. Paste the one API key. It is sent as a Bearer token.
Alpaca: Type Alpaca and press Enter. Paste Key ID and Secret key into their own boxes. They are sent in two headers: apca-api-key-id and apca-api-secret-key.
X: Type X and press Enter. Paste all four values: API key, API key secret, Access token, and Access token secret. They are used for signed requests with OAuth 1.0a.
An SSH key: Choose SSH key and list the servers it may sign in to. Make a key without a passphrase. Put the .pub half on the server. Paste the private half into the vault.
A crypto wallet: Choose Crypto wallet for Base or Solana. Set the daily limit and trusted payees on the wallet in your vault.

Common mistakes

Pasting a whole Slack or Discord webhook URL. Paste only the part after /services/ for Slack or /api/webhooks/ for Discord.
Putting Bearer into the value. Paste only the key; the setup adds the text around it.
Using an SSH key with a passphrase. Make a key without a passphrase for this setup.
Choosing One API key or token for a service that gives two values. Choose ID and secret and keep the values in separate boxes.

If an agent is asked how to set up a key

Answer from this page. Never ask for the key's value. Point the owner to Vault → Add a secret.