Store secrets securely

Keep passwords, cards, API keys, and other credentials out of chat and ordinary files. Save logins, cards, and contact info in Vault so your Bot can sign in and check out for you. Use the secure secret card for API keys. After you save a secret, Grok Bot does not show the value again. A blank field later is not proof the secret was deleted.

What is Vault?

Vault keeps your logins, cards, and contact info so your Bot can sign in to sites and check out for you without seeing the secret values. Find it in Settings > Vault on desktop and on the phone. You can add, edit, or remove anything there. Vault needs Grok Bot 0.75.2 or later.

Logins: a website, a username or email, and a password. Your Bot uses a saved login to sign in on that website.
Cards: the number, expiry, security code, name on card, and billing address.
Contact info: names, addresses, phone numbers, and emails for shipping and billing.

Your Bot never sees a saved password, card number, or security code. It can see your contact info and which logins you saved, so it can pick the right entry and type contact details in for you.

Vault covers your whole account. Everything you save is available to every Bot on your account, and you can't limit an item to one Bot.

Vault isn't supported on shared Bots. For a shared Bot, add keys under Secrets instead. See How should I add an API key or secret?

Open Settings > Vault and choose New item.
Pick Login, Card, or Contact info.
Fill in the details and save.
- For a login, enter the Website, Username or email, and Password, then choose Save login.
- For a card, choose Scan with camera or Upload a photo to fill it from the card, or type it in. Then choose Save card.
- For contact info, enter the name, address, phone, and email, then choose Save contact info.

Under Hints, tell your Bot when to use an entry, for example "Use for work purchases". Your Bot follows the hint when it picks between entries.

You can also save from a chat:

When your Bot asks for a login, card, or address with a Secure Form, check Securely save to Bot's vault to keep it for next time. If you leave it unchecked, the value is kept only for that chat and expires on its own.
When you attach a photo of a card, Grok Bot offers Save to Vault so your Bot can pay with it later.

How do I import logins from another password manager?

On desktop, you can import logins from a CSV export.

Export your passwords as a CSV file from 1Password, Chrome or Edge, Safari or Apple Passwords, Firefox, Bitwarden, or LastPass.
In Settings > Vault, choose New item, then Import from CSV….
Select Choose CSV file and pick the export. The file is read on your computer and never uploaded. It must be under 5 MB.
Review the list. Items already in your vault are skipped. Rows with an error, such as a missing password or a website that isn't https, aren't imported.
Choose the import button, which shows how many items are ready.

LastPass exports bring cards along too. The exported CSV holds your passwords unencrypted, so delete it once the import finishes.

How does my Bot use Vault?

Signing in: your Bot uses a saved login first, then a connected password manager such as 1Password. If neither has the login, it asks you with a Secure Form.
New accounts: if you let your Bot pick the password when it signs up for a site, Vault generates the password and saves the login. Your Bot never sees it.
Checkout: saved cards fill in at checkout, and contact info fills in shipping and billing details. See Will my Bot ask before it uses a saved card?
Details you share in chat: when you give your Bot a name, address, phone number, or email, it saves it as contact info once the task is done and tells you what it saved. Tell it if you don't want something kept.

Your Bot can change contact info, and an entry's nickname and hints, when you ask. Passwords, usernames, websites, card numbers, and security codes change only in Settings > Vault. Logins and cards are removed only there too.

Will my Bot ask before it uses a saved card?

Not necessarily. Saving a card in Vault lets your Bots fill it in at checkout, and there's no setting that requires your approval each time a saved card is used.

If you want to approve each payment yourself, don't save the card:

When your Bot asks for a card with a Secure Form at checkout, leave Securely save to Bot's vault unchecked. The card is used only in that chat. A form without that checkbox saves straight to Vault, so don't submit it.
If you already saved a card, open Settings > Vault, select it, and choose Remove. After that, Grok Bot can no longer pay with it.

How do I change or remove a Vault item?

Open Settings > Vault and select the item to edit it, or choose Remove to delete it. After you remove a login, Grok Bot can no longer sign in to that site with it. After you remove a card, Grok Bot can no longer pay with it.

To change a card's number, remove the card and add it again. On the phone, saved cards can't be edited yet.

On Grok Bot for iPhone 1.18.0 with iOS 26 or later, Settings > Vault > New item > Login shows only a back button, so a login typed there can't be saved. Cards and contact info aren't affected. This is fixed in iPhone 1.19.0, which is rolling out on the App Store. Update when the App Store offers it to you, or open the App Store and update Grok Bot yourself.

On 1.19.0, Save is at the top of the form and stays off until you fill in the Name, Website, and Password. Until you update, add the login from Grok Bot on your computer, or ask your Bot to sign in to that site and save the login from the Secure Form it shows in the chat.

How should I add an API key or secret?

For an API key or other secret that isn't a login or card, use the secure secret card when a Bot asks for one. The field is masked. Choose Save securely. The card then says Saved and Saved securely and kept private. The value is not written into the chat.

On a shared Bot you own or manage, you can also add a secret from the Bot's details. Open Secrets, choose Add secret, enter an environment variable name, a short description, and the value, then choose Save secret. The description is visible to the Bot. The value is not.

Don't paste secrets into chat, Shell, or ordinary files. Don't type them into a demonstration when you use Teach a task.

Secrets you save are yours. On a shared Bot you own or manage, secrets are used in every teammate's chat, so only add keys you're happy for everyone who can chat with the Bot to use. A credential your company's setup scripts need, such as a license key for a tool installed on every team computer, is stored by a team admin as a Team Secret on the Enterprise dashboard instead. Those never reach your Bots directly.

Why can't I see the secret value?

That is expected. Saved values are write-only.

In Settings > Vault, saved passwords stay hidden, and cards show only their last four digits.
The secure secret card does not show the value after Saved. The footer says Stored securely, never shown to your Bot.
On a shared Bot, Secrets lists the name and description only. It never shows the value again, including in Shell.
To change a value there, choose Replace, paste the new value, and choose Replace value. You cannot read the old value back.

If a page asked for the secret, a filled card says Filled into the page. Secret values were never shown to your Bot. If it says Could not fill into the page, the page may have moved. The value was still not shown to the Bot. Submit a new card if the Bot asks again.

If save fails, the form says The secret was not saved. Try again. If a shared Bot's Secrets list says Something went wrong. Try again., choose Try Again. No secrets yet means that Bot has no saved names, not that a value is hidden on the card.

Did Update delete my secrets?

Recover, Reset, and computer updates remove installed apps and packages. A secret you typed into a file, a shell profile, or an installed tool on the computer can disappear with that. That is separate from secrets you saved with the secure card, under Secrets, or in Vault.

Shell not printing a secret does not mean it was wiped. On a shared Bot, if the name is still listed under Secrets, the value is still stored. See Grok Bot computer for what Update, Recover, and Reset keep.

If a shared Bot's secret name is gone and you did not choose Remove:

Fully quit Grok Bot and reopen it. On Mac, choose Quit from the menu bar, not just close the window.
Open the same Bot on another device signed into the same Cursor account.
If the list says Something went wrong. Try again., choose Try Again before you add anything.

If the name is still missing on every device, add it again. Don't put it in a file to "keep a copy" on the computer. If names keep disappearing after you did not remove them, contact support. Include your account email and a screenshot of Secrets. Don't send the secret value.

Store secrets securely

What is Vault?

Logins: a website, a username or email, and a password. Your Bot uses a saved login to sign in on that website.
Cards: the number, expiry, security code, name on card, and billing address.
Contact info: names, addresses, phone numbers, and emails for shipping and billing.

Your Bot never sees a saved password, card number, or security code. It can see your contact info and which logins you saved, so it can pick the right entry and type contact details in for you.

Vault covers your whole account. Everything you save is available to every Bot on your account, and you can't limit an item to one Bot.

Vault isn't supported on shared Bots. For a shared Bot, add keys under Secrets instead. See How should I add an API key or secret?

Open Settings > Vault and choose New item.
Pick Login, Card, or Contact info.
Fill in the details and save.
- For a login, enter the Website, Username or email, and Password, then choose Save login.
- For a card, choose Scan with camera or Upload a photo to fill it from the card, or type it in. Then choose Save card.
- For contact info, enter the name, address, phone, and email, then choose Save contact info.

Under Hints, tell your Bot when to use an entry, for example "Use for work purchases". Your Bot follows the hint when it picks between entries.

You can also save from a chat:

When your Bot asks for a login, card, or address with a Secure Form, check Securely save to Bot's vault to keep it for next time. If you leave it unchecked, the value is kept only for that chat and expires on its own.
When you attach a photo of a card, Grok Bot offers Save to Vault so your Bot can pay with it later.

How do I import logins from another password manager?

On desktop, you can import logins from a CSV export.

Export your passwords as a CSV file from 1Password, Chrome or Edge, Safari or Apple Passwords, Firefox, Bitwarden, or LastPass.
In Settings > Vault, choose New item, then Import from CSV….
Select Choose CSV file and pick the export. The file is read on your computer and never uploaded. It must be under 5 MB.
Review the list. Items already in your vault are skipped. Rows with an error, such as a missing password or a website that isn't https, aren't imported.
Choose the import button, which shows how many items are ready.

LastPass exports bring cards along too. The exported CSV holds your passwords unencrypted, so delete it once the import finishes.

How does my Bot use Vault?

Signing in: your Bot uses a saved login first, then a connected password manager such as 1Password. If neither has the login, it asks you with a Secure Form.
New accounts: if you let your Bot pick the password when it signs up for a site, Vault generates the password and saves the login. Your Bot never sees it.
Checkout: saved cards fill in at checkout, and contact info fills in shipping and billing details. See Will my Bot ask before it uses a saved card?
Details you share in chat: when you give your Bot a name, address, phone number, or email, it saves it as contact info once the task is done and tells you what it saved. Tell it if you don't want something kept.

Will my Bot ask before it uses a saved card?

Not necessarily. Saving a card in Vault lets your Bots fill it in at checkout, and there's no setting that requires your approval each time a saved card is used.

If you want to approve each payment yourself, don't save the card:

When your Bot asks for a card with a Secure Form at checkout, leave Securely save to Bot's vault unchecked. The card is used only in that chat. A form without that checkbox saves straight to Vault, so don't submit it.
If you already saved a card, open Settings > Vault, select it, and choose Remove. After that, Grok Bot can no longer pay with it.

How do I change or remove a Vault item?

To change a card's number, remove the card and add it again. On the phone, saved cards can't be edited yet.

How should I add an API key or secret?

Don't paste secrets into chat, Shell, or ordinary files. Don't type them into a demonstration when you use Teach a task.

Why can't I see the secret value?

That is expected. Saved values are write-only.

In Settings > Vault, saved passwords stay hidden, and cards show only their last four digits.
The secure secret card does not show the value after Saved. The footer says Stored securely, never shown to your Bot.
On a shared Bot, Secrets lists the name and description only. It never shows the value again, including in Shell.
To change a value there, choose Replace, paste the new value, and choose Replace value. You cannot read the old value back.

Did Update delete my secrets?

If a shared Bot's secret name is gone and you did not choose Remove:

Fully quit Grok Bot and reopen it. On Mac, choose Quit from the menu bar, not just close the window.
Open the same Bot on another device signed into the same Cursor account.
If the list says Something went wrong. Try again., choose Try Again before you add anything.

Store secrets securely

What is Vault?

Logins: a website, a username or email, and a password. Your Bot uses a saved login to sign in on that website.
Cards: the number, expiry, security code, name on card, and billing address.
Contact info: names, addresses, phone numbers, and emails for shipping and billing.

Your Bot never sees a saved password, card number, or security code. It can see your contact info and which logins you saved, so it can pick the right entry and type contact details in for you.

Vault covers your whole account. Everything you save is available to every Bot on your account, and you can't limit an item to one Bot.

Vault isn't supported on shared Bots. For a shared Bot, add keys under Secrets instead. See How should I add an API key or secret?

Open Settings > Vault and choose New item.
Pick Login, Card, or Contact info.
Fill in the details and save.
- For a login, enter the Website, Username or email, and Password, then choose Save login.
- For a card, choose Scan with camera or Upload a photo to fill it from the card, or type it in. Then choose Save card.
- For contact info, enter the name, address, phone, and email, then choose Save contact info.

Under Hints, tell your Bot when to use an entry, for example "Use for work purchases". Your Bot follows the hint when it picks between entries.

You can also save from a chat:

When your Bot asks for a login, card, or address with a Secure Form, check Securely save to Bot's vault to keep it for next time. If you leave it unchecked, the value is kept only for that chat and expires on its own.
When you attach a photo of a card, Grok Bot offers Save to Vault so your Bot can pay with it later.

How do I import logins from another password manager?

On desktop, you can import logins from a CSV export.

Export your passwords as a CSV file from 1Password, Chrome or Edge, Safari or Apple Passwords, Firefox, Bitwarden, or LastPass.
In Settings > Vault, choose New item, then Import from CSV….
Select Choose CSV file and pick the export. The file is read on your computer and never uploaded. It must be under 5 MB.
Review the list. Items already in your vault are skipped. Rows with an error, such as a missing password or a website that isn't https, aren't imported.
Choose the import button, which shows how many items are ready.

LastPass exports bring cards along too. The exported CSV holds your passwords unencrypted, so delete it once the import finishes.

How does my Bot use Vault?

Signing in: your Bot uses a saved login first, then a connected password manager such as 1Password. If neither has the login, it asks you with a Secure Form.
New accounts: if you let your Bot pick the password when it signs up for a site, Vault generates the password and saves the login. Your Bot never sees it.
Checkout: saved cards fill in at checkout, and contact info fills in shipping and billing details. See Will my Bot ask before it uses a saved card?
Details you share in chat: when you give your Bot a name, address, phone number, or email, it saves it as contact info once the task is done and tells you what it saved. Tell it if you don't want something kept.

Will my Bot ask before it uses a saved card?

Not necessarily. Saving a card in Vault lets your Bots fill it in at checkout, and there's no setting that requires your approval each time a saved card is used.

If you want to approve each payment yourself, don't save the card:

When your Bot asks for a card with a Secure Form at checkout, leave Securely save to Bot's vault unchecked. The card is used only in that chat. A form without that checkbox saves straight to Vault, so don't submit it.
If you already saved a card, open Settings > Vault, select it, and choose Remove. After that, Grok Bot can no longer pay with it.

In Settings > Vault, saved passwords stay hidden, and cards show only their last four digits.
The secure secret card does not show the value after Saved. The footer says Stored securely, never shown to your Bot.
On a shared Bot, Secrets lists the name and description only. It never shows the value again, including in Shell.
To change a value there, choose Replace, paste the new value, and choose Replace value. You cannot read the old value back.

Did Update delete my secrets?

If a shared Bot's secret name is gone and you did not choose Remove:

Fully quit Grok Bot and reopen it. On Mac, choose Quit from the menu bar, not just close the window.
Open the same Bot on another device signed into the same Cursor account.
If the list says Something went wrong. Try again., choose Try Again before you add anything.

Store secrets securely

What is Vault?

How do I import logins from another password manager?

How does my Bot use Vault?

Will my Bot ask before it uses a saved card?

How do I change or remove a Vault item?

How should I add an API key or secret?

Why can't I see the secret value?

Did Update delete my secrets?

Was this article helpful?

Store secrets securely

What is Vault?

How do I import logins from another password manager?

How does my Bot use Vault?

Will my Bot ask before it uses a saved card?

How do I change or remove a Vault item?

How should I add an API key or secret?

Why can't I see the secret value?

Did Update delete my secrets?

Was this article helpful?

Store secrets securely

What is Vault?

How do I import logins from another password manager?

How does my Bot use Vault?

Will my Bot ask before it uses a saved card?

How do I change or remove a Vault item?

How should I add an API key or secret?

Why can't I see the secret value?

Did Update delete my secrets?

Was this article helpful?