---
name: "vault_save"
area: "vault"
title: "Save a secret"
price: "$0.001"
method: "POST"
url: "https://api.conecto.chat/v1/tools/vault_save"
mcp_server: "https://api.conecto.chat/mcp/vault"
auth: "Authorization: Bearer <conecto_sk_ key>"
docs_url: "https://conecto.chat/tools/vault/vault_save"
---

# Save a secret (`vault_save`)

Keeps a secret (an API key, a password, a login) encrypted under a name; saving under a name in use replaces it.

Keep a secret (an API key, a password, a login) encrypted in the account's vault under a name, to read back later with vault_get. Saving under an existing name replaces it. username, url and note are not secret and show in vault_list. With bots, only those of the account's bots may read it.

Price: $0.001 a call. A call that fails costs nothing.

## Use it when

The agent will need a secret later: a supplier portal's login, a shipping service's API key.

- For a new random password, use [vault_generate_password](https://conecto.chat/tools/vault/vault_generate_password.md).

## Say this to your agent

> Keep our login for the Cascade Bike Supply dealer portal. The user is orders@halversoncycle.example, and the password is in my next message.

## Inputs

| Name | Type | Required | Description | Allowed values | Default |
|---|---|---|---|---|---|
| `name` | string | yes | e.g. "Shopify admin" or "SUPPLIER_API_KEY". Matches ^[A-Za-z0-9][A-Za-z0-9 ._-]{0,79}$. |  |  |
| `value` | string | yes | 1 to 10,000 characters. Stored encrypted and shown only as [redacted]. |  |  |
| `username` | string | no | Up to 200 characters. |  |  |
| `url` | string | no | Up to 500 characters. |  |  |
| `note` | string | no | Up to 500 characters. |  |  |
| `bots` | array of string or integer | no | Bot names (or key ids) allowed to read it; all of the account's bots if left out. Up to 20 items. |  |  |

## Example

Written for Halverson Cycle & Repair, a bike shop with a repair workshop in Portland, Oregon.

MCP: call `vault_save` on the MCP server `https://api.conecto.chat/mcp/vault` with these arguments:

```json
{
  "name": "Cascade dealer portal",
  "value": "birch-anchor-saddle-1871",
  "username": "orders@halversoncycle.example",
  "url": "https://dealers.cascadebikesupply.example",
  "note": "Parts orders. Sam Reyes knows the account."
}
```

REST:

```bash
curl https://api.conecto.chat/v1/tools/vault_save \
  -H "Authorization: Bearer $CONECTO_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Cascade dealer portal", "value": "birch-anchor-saddle-1871", "username": "orders@halversoncycle.example", "url": "https://dealers.cascadebikesupply.example", "note": "Parts orders. Sam Reyes knows the account."}'
```

## Response

```json
{
  "call_id": "5f0c8a2e-3b7d-4c1e-9a64-2d8e1f7b0c93",
  "tool": "vault_save",
  "status": "succeeded",
  "replayed": false,
  "cost_usd": "$0.001",
  "balance_usd": "$19.75",
  "result": {
    "saved": "Cascade dealer portal",
    "replaced": false,
    "secret": {
      "name": "Cascade dealer portal",
      "username": "orders@halversoncycle.example",
      "url": "https://dealers.cascadebikesupply.example",
      "note": "Parts orders. Sam Reyes knows the account.",
      "bots": "all",
      "updated_at": "2026-10-14T08:00:00+00:00",
      "last_read_at": null,
      "reads": 0
    }
  }
}
```

`result`: saved: the name; replaced: whether it replaced a secret; secret: its name, username, url, note, the bots that may read it, and when it was saved and read. Never the value.

## Errors

| Code | Status | When | Fix |
|---|---|---|---|
| `not_found` | 404 | A bot named in bots is not one of the business's. | Use bot names from GET /v1/keys. |
| `forbidden` | 403 | The secret is limited to other bots of the business. | Ask the owner, or the bot that saved it, to add this bot. |
| `name_taken` | 409 | Another call saved a secret with that name at the same moment. | Call again. |
| `limit_reached` | 409 | The vault holds 500 secrets already. | Delete some with vault_delete. |
| `unavailable` | 503 | The vault is not available right now. | Try again later; nothing was charged. |

The refusals every tool can give (401 key, 402 balance, 429 limits) are on the errors page: https://conecto.chat/docs/errors.md

## Related

- [vault_get](https://conecto.chat/tools/vault/vault_get.md): A secret's value, for this call only; it is never kept in the call log, and each read is counted. Free up to 1,000,000 reads a month.
- [vault_list](https://conecto.chat/tools/vault/vault_list.md): The vault's secrets with their username, url, note, who may read them and when they were last read; never the values. Free up to 1,000,000 reads a month.
- [vault_generate_password](https://conecto.chat/tools/vault/vault_generate_password.md): Makes a random password and saves it straight into the vault under a name; it is shown for this call only. $0.001 a call.
- [vault_delete](https://conecto.chat/tools/vault/vault_delete.md): Removes a secret from the vault, for good. Free.