Manage secrets across the IDE and Dev

Where a credential should live depending on what's going to use it.

Preview — early access.

Overview

Creytix has two related but distinct places a secret can live: the IDE's mini vault (for pasting a credential into a chat safely) and the Dev BYOK vault (for a model provider key the agent router calls directly). This guide is about picking the right one.

How it works

If you're handing a credential to the AI agent's conversation — something you'd otherwise paste into chat, like a third-party API key the agent needs to reference — use the IDE's mini vault: it's paste-only, and the agent only ever sees a {{vault:NAME}} reference. If you're giving the model router itself a provider key so a specific model (Grok, Kimi, Gemini, GPT-4o mini, and so on) can respond at all, that's the Dev BYOK vault instead.

Steps

•
Ask what the secret is for
A key a model provider needs to answer requests → BYOK vault. A credential you want to reference in conversation without exposing it → mini vault.
•
Provider key → BYOK vault
Open Creytix Dev, add the provider key to the BYOK vault, and confirm it shows as connected.
•
Conversation credential → mini vault
Set a vault passphrase in the IDE's Secrets tab, then use the 🔒 paste button from any chat to stash it and insert a {{vault:NAME}} reference.
•
Verify the model side
Check the Models tab — a model with its key configured shows ●; one still needing a key shows ○.
•
Rotate when needed
Rotating either kind of secret means updating it at its source (the vault entry) — references elsewhere keep pointing at the same name.

Capabilities

Two purpose-built vaults instead of one catch-all secrets box — provider keys for the router, paste-only secrets for chat.
Never-typed capture in the mini vault — a secret is pasted, masked, and referenced, never rendered in full or sent to the AI.
Per-provider key status visible directly in the Models tab.

Limits & honest scope