Skip to main content

Organization API keys

Settings → API Keys stores your organization's AI provider keys (Anthropic, Gemini, OpenAI) in the built-in encrypted vault. They are:

  • encrypted at rest (AES-256-GCM by default, or stored in HashiCorp/Azure/GCP/AWS vault when the instance is configured with an external vault provider),
  • injected automatically into dev boxes so developers never paste keys into sandboxes,
  • readable only by admins (members can see how many secrets are stored, never their values).

Settings

Good practices​

  • Put provider keys here, not in .env files — Shield exists precisely because keys keep leaking through command output.
  • Rotate a key by storing the new value under the same name; the old value is overwritten.
  • The Anthropic key set under Settings → General is validated (it must start with sk-ant-). The vault page here accepts any value as-is, so double-check keys before saving.