Overview

Vault is ARMS's built-in secrets manager for LLM API keys and other sensitive values. Instead of pasting an API key into every codebase, .env file, or teammate's laptop, you store it once in Vault and let any application fetch it at runtime - decoupling key rotation from redeploys.

Why Vault

Vault has no direct built-in equivalent in most LLM observability tools - typically you're expected to manage API keys yourself, through your own environment variables or a general-purpose secrets manager. ARMS centralizes secrets so that any application (not just ARMS itself) can fetch them at runtime through the SDK or API. That means rotating a key in Vault takes effect the next time an application fetches it - no restarts or redeploys required.

Vault secrets are also usable directly inside ARMS: the Evaluation configuration screen, the Chat settings screen.

Frequently asked questions

What is Vault used for?

Vault centrally stores secrets like LLM API keys, encrypted at rest with AES-256-GCM, so applications can retrieve them remotely via SDK or API instead of embedding keys in code or environment files.

Can secrets be rotated without redeploying?

Yes. Since applications fetch secrets from Vault at runtime, rotating a key in Vault takes effect on the next fetch - no restarts or redeploys needed.

Is Vault safe to call from a browser?

Vault enforces API-key authentication and CORS. Browser-based cross-origin calls require adding your app's origin to ELSAI_ALLOWED_CORS_ORIGINS; server-to-server calls are unaffected. Invalid keys return 401. Disallowed origins return 403.

Can I change a secret's Key after creating it, or view its Value later?

No to both, by design. A secret's Key becomes read-only once it's created - you'd need to create a new secret under a different Key instead. The Value is write-only: it's never sent back to the browser, so the Value field is always blank when you open a secret to edit it. Leave it blank to keep the existing value, or type a new one to overwrite it.