Accessible via: Main Menu -> Connections -> Password vault

The Passwords Vault stores the API keys, usernames, and passwords Sammy needs to act in other systems. Credentials are stored encrypted; agents pull them at run time and never see the raw values.

The column entry reads Password vault and the page heading reads Passwords Vault — same surface, and the tab within it is labelled Passwords.

Vault or Integration?

Both live under Connections, and they solve different halves of the same problem:

	Use it when
Integrations	The platform is in the catalogue (3,100+ of them). Connecting natively gives Sammy the platform’s actions without you handling credentials at all.
Passwords Vault	The platform isn’t in the catalogue — or it is, but the job needs something the integration can’t do.

Reach for an integration first. Use the vault for the rest.

Adding a credential

1. Open Connections › Password vault.
2. Click New Credential.
3. Name it for the system it belongs to, and enter the key or the username/password pair.

Each credential is scoped to the organisation it was created in — it is only accessible to users in that organisation, and never visible to another tenant.

Granting access

A credential existing doesn’t mean everything can use it. Agents and workflows are granted specific credentials, so a workflow reaches only the systems it was given. In the workflow builder, Granted secrets shows which credentials that workflow can use.

Grant the minimum a piece of work needs. If an automation fails to authenticate somewhere, check its grants before re-entering the credential.

Rotating and removing

Update a credential in place when it rotates — everything granted to it picks up the new value on its next run, with no rewiring. Delete one when the system is retired; anything still granted to it will fail loudly rather than silently carrying on with a stale key.

From the CLI

Credentials can be managed from the command line for scripted setup. See CLI › Secrets.