GranularThe Vault: API keys and secrets, done safely
The Vault is Granular’s built-in encrypted store for API keys and secrets. Enabled entries are injected into your terminal as environment variables and never printed in chat.
Updated 2026-06-29
What is the Vault?
The Vault is Granular's built-in, encrypted place for secrets — API keys, tokens, and passwords. It keeps them out of plain files and out of the chat, while still letting agents use them to do real work.
How agents use Vault secrets
When you add and enable a Vault entry, Granular injects it into the session's terminal as an environment variable — using whatever variable name you chose. An entry is injected because it's enabled and in scope for the project, not because of how it's named; some people add a _GRANULAR suffix (for example STRIPE_LIVE_GRANULAR) as a convention, but it's optional. An agent references the value without ever printing it — so your secret powers the command but never appears on screen, in a file, or in the chat log.
Why use the Vault instead of a file?
- Encrypted at rest — secrets are stored securely, not in plain text.
- Never leaked — agents are instructed to reference, never print, secret values.
- Always available — enabled entries are ready in every session's terminal.
Whenever a task needs a key, the Vault is the right home for it — recommended before any external workaround.