> ## Documentation Index
> Fetch the complete documentation index at: https://docs.elementum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments Secret Vault

> Store keys and secrets in an environment-scoped vault so configuration values vary by environment without hardcoding, with write-only secrets, access policies, and reference by key name in automations

The Vault is a secure, environment-scoped store for the keys and secrets your configuration depends on — API keys, endpoints, and other values that change from one environment to the next. Storing them in the Vault lets a single automation reference a value by key name and resolve to the right value in each environment, so you never hardcode secrets or rewrite configuration when you promote work between environments.

Find it in **Organization Settings** under the **Platform** section, on the **Vault** page.

## Add a vault entry

Organization Administrators create and manage vault entries.

1. Open **Organization Settings** > **Platform** > **Vault**.
2. Click **+ Add Entry**.
3. Enter the **Key**, **Value**, and **Description**.
4. Toggle on **Secret** if the value is sensitive, such as an API key.
5. Click **Create**.

## Keys across environments

Each vault entry has a **key** and a **value**. The key is the name automations reference (for example, `API_KEY`). The value is what that key resolves to in the current environment.

When you add an entry in one environment, Elementum automatically creates the same key in every other environment — without copying the value. Other environments show the entry as **Not configured** until you add a value there. That is intentional: Development, Staging, and Production typically need different credentials for the same key.

For example, you add an API key in Production with the key `API_KEY` and the Production value. In Development you will see an unconfigured entry for `API_KEY` — the key is already there, but the value is empty. Set a Development value when you have a credential for that environment.

## Manage access policies

Each entry has its own access policy that controls who can view or manage it.

1. On the **Vault** page, click the entry you want to manage.
2. Select the **Access Policies** tab, where you control who can view or manage the entry. The creator is automatically added as a User.

## Reference vault entries in automations

Vault entries can be referenced by key name as values in automations. Because the reference resolves to the value stored for the current environment, promoting an automation across environments automatically points it to the right value, and updates to a value take effect immediately.

## Behavior notes

* When an entry is marked as **Secret**, it becomes write-only — no one can read the value after it is set.
* Adding an entry in one environment adds the key to every other environment. Values are never copied; each environment stays **Not configured** until you set its own value. See [Keys across environments](#keys-across-environments).
* Access is controlled per entry through its **Access Policies** tab.