Items & fields

An item is a single secret and everything you need to use it. Keyvault gives each item a type so its fields match what you are storing, and adds tags, attachments, and search to keep large vaults manageable.

Item types

Choose a type when you create an item with + New item. The type decides which fields appear by default.

Type	Default fields	Use it for
Login	Username, password, website	Web apps and dashboards, such as an internal admin console
API key	Key or token, optional secret, endpoint	Service credentials like a Deploy Key or third-party API token
Secure note	Free-form encrypted text	Recovery codes, runbooks, connection strings

All types support the same extras below — custom fields, tags, and attachments — so you can adapt any item to what your team needs.

Fields

Each field has a label and a value. Values marked as concealed are hidden behind dots until you reveal them, and every field has a one-click copy button that clears the clipboard shortly after.

Adding custom fields

Open an item, select Edit, then Add field. Pick a field type:

• Text — visible values like a username, region, or account ID.
• Concealed — hidden values like a password or token.
• URL — links that become clickable and power autofill matching.
• One-time code — store a 2FA setup so Keyvault can generate the rotating code for you.

Attachments

Some secrets come as files — a certificate, a key file, or a configuration export. Attach them directly to an item:

1. Open the item and select Add attachment.
2. Choose the file. It is encrypted on your device before it syncs, exactly like every other field.
3. Teammates with access to the item can download it according to their permission level.

Tags

Tags are lightweight labels that cut across vaults. Add tags such as prod, ci, or on-call to an item, then filter a vault or the whole app by tag.

A few conventions that scale well:

• Use an environment tag: prod, staging, dev.
• Use an owner or system tag: payments, data-platform.
• Keep tags lowercase and consistent so filtering stays predictable.

Search

The search box at the top searches across every vault you can see. Keyvault matches on item name, tags, and any URL fields, so a login for your internal dashboard turns up whether you search its name or its address.

Search operators help narrow results:

deploy tag:ci          # items named "deploy" tagged ci
vault:Engineering      # only the Engineering vault
type:login prod        # logins matching "prod"

Star frequently used items to keep them in your Favorites for instant access.

Item history

Keyvault keeps a version history of changes to an item. Open an item's history to see when a field changed and, if needed, restore a previous value. This is handy after a rotation if a new credential does not work and you need the prior one while you investigate.

Next steps

• Sharing & permissions — share an item or its whole vault with the right access level.
• CLI — read item fields from scripts and pipelines.