Connect a harness

1. Add a secret

Sign in, choose your personal or organization workspace, and select Add secret. Enter a project, name and value. The app encrypts the value and saves it. Saved values are write-only in the web app; use Rotate to replace one.

2. Create harness access

Open Harnesses → Connect harness. Choose its name, expiry and allowed secrets. Agent Vault creates its identity and access grants. Copy the access token into your harness’s protected runtime settings. It is shown once.

3. Configure your runtime

Sign in to choose your harness and secrets for a setup block with your exact references. The example below already names this vault. Store the one-time access token in VAULT_HARNESS_TOKEN on the runtime, not in the chat. The model names references such as secret://WORKSPACE/PROJECT/NAME. Only trusted harness code resolves them.

4. Control access

Use Harnesses → Access to grant or revoke a secret. Use Retire to block the harness and its descendants from future resolutions. Previously delivered values cannot be recalled.

Worker delegation

Copy this into the same harness when it needs to delegate. Trusted code calls POST /v1/spawn with a child name, narrower scopes and a shorter expiry, then keeps the returned token in that worker’s runtime. POST /v1/retire retires that worker.

Where tools run

The vault is a remote credential service. Tools execute wherever your harness runs. A cloud harness connects directly; you do not need a local vault, encryption key, database, Railway account or operator token.

Workspace management

Your personal vault is private to your account. Organization vaults require an active organization-admin membership to manage. Agent Vault verifies your session and membership on each management request and selects the workspace on the server.