Credentials

Credentials are the secrets stored in your vault. Each credential is individually encrypted with its own data encryption key (DEK).

Credential Structure

Every credential has:

Field	Description
`path`	Hierarchical name (e.g., `openai/api_key`, `aws/prod/access_key`)
`type`	Classification: `api_key`, `token`, `password`, `certificate`, `ssh_key`, `oauth_token`
`value`	The encrypted secret material
`description`	Human-readable description
`metadata`	Optional key-value pairs
`created_at`	Timestamp of creation
`updated_at`	Timestamp of last update
`access_count`	Number of times retrieved

Path Conventions

Credentials use hierarchical slash-separated paths. This enables glob-pattern matching in policies:

openai/api_key              # Simple key
aws/prod/access_key         # Namespaced by environment
aws/prod/secret_key
github/personal/token       # Namespaced by scope
github/org/deploy_key

Note: Paths are case-sensitive. Use lowercase with slashes for consistency.

Credential Types

Type	Use Case
`api_key`	REST API keys (OpenAI, Anthropic, Stripe)
`token`	Bearer tokens, JWTs, session tokens
`password`	Database passwords, service accounts
`certificate`	TLS certificates, client certs
`ssh_key`	SSH private keys
`oauth_token`	OAuth2 access/refresh tokens

The type is used for policy matching and audit reporting. It doesn’t affect encryption — all types are encrypted identically.

Leases

When an agent retrieves a credential through MCP or the API, it receives a lease — a time-limited reference to the secret value. Leases enforce the max_ttl configured in the access policy.

Agent requests "openai/api_key"
      │
      ▼
Policy check → max_ttl: 300s
      │
      ▼
Lease created: { value: "sk-...", expires_at: now + 300s }
      │
      ▼
After 300s: lease expires, value is zeroized from memory

Leases ensure that even if an agent’s process is compromised, the window of exposure is limited.

Storage Commands

# Store interactively (secure input)
sanctum store myservice/api_key --type api_key
 
# Store with description
sanctum store myservice/api_key --type api_key --description "Production API key"
 
# List all credentials
sanctum list
 
# Retrieve a credential
sanctum get myservice/api_key
 
# Delete a credential
sanctum remove myservice/api_key

Vaults Agents