> ## Documentation Index
> Fetch the complete documentation index at: https://docs.elementum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments Secret Vault

> Store keys and secrets in an environment-scoped vault so configuration values vary by environment without hardcoding, with write-only secrets, access policies, and reference by key name in automations

The Vault is a secure, environment-scoped store for the keys and secrets your configuration depends on — API keys, endpoints, and other values that change from one environment to the next. Storing them in the Vault lets a single automation reference a value by key name and resolve to the right value in each environment, so you never hardcode secrets or rewrite configuration when you promote work between environments.

Find it in **Organization Settings** under the **Platform** section, on the **Vault** page.

## Add a vault entry

Organization Administrators create and manage vault entries.

1. Open **Organization Settings** > **Platform** > **Vault**.
2. Click **+ Add Entry**.
3. Enter the **Key**, **Value**, and **Description**.
4. Toggle on **Secret** if the value is sensitive, such as an API key.
5. Click **Create**.

## Manage access policies

Each entry has its own access policy that controls who can view or manage it.

1. On the **Vault** page, click the entry you want to manage.
2. Select the **Access Policies** tab, where you control who can view or manage the entry. The creator is automatically added as a User.

## Reference vault entries in automations

Vault entries can be referenced by key name as values in automations. Because the reference resolves to the value stored for the current environment, promoting an automation across environments automatically points it to the right value, and updates to a value take effect immediately.

## Behavior notes

* When an entry is marked as **Secret**, it becomes write-only — no one can read the value after it is set.
* Each environment shows the value as **Not configured** until a value is added for that environment.
* Access is controlled per entry through its **Access Policies** tab.