HOW-TO
Add and use secrets safely
Store credentials in the encrypted vault, choose who can use them and refer to them by name in agents and tool setups. Never paste keys into chat.
STEPS
Add and use secrets. Permission then reference.
- Add a secret
Create a vault entry with a clear name and label. It is private by default.
- Permission
Give use or manage rights to the right people and groups.
- Refer by name
Point agent packages and tool setups at the secret’s name.
- Substitute
Controlled substitution applies the value when it is used. It is designed to keep the raw key out of the model’s context.
- Do not
Do not paste keys into prompts, Slack or agent config files checked into git.
GOOD PRACTICE
What good practice looks like
- Encrypted at rest
The vault stores values encrypted.
- Least privilege
Give use without manage. People can run agents without owning every key.
- Share with the organisation only if needed
Share a credential with everyone only when the whole organisation should use it.
- Tied to packages
Agents carry the names of secrets, never the secrets themselves.
RELATED
Keep exploring.
- Resources hub
Practical guides to setting up and using Joyst.
Open - Secrets vault
Keys kept out of model context.
Open - How to stop pasting API keys
Store keys in the vault instead of pasting them into chat.
Open - Controlled substitution
Use vault secrets by name. Designed to keep keys out of the model’s context.
Open - Create an agent package
Assemble skills, MCP servers, prompts and secrets into one setup.
Open - Stop pasting API keys: why it fails
Why pasting keys into AI chat fails audits.
Open - Agents
Package skills, prompts, MCP servers and secrets into reusable setups.
Open - Sharing and permissions
Private, group and organisation sharing, explained.
Open - Use OAuth instead of API keys
How MCP OAuth sign-in works, step by step.
Open - How it compares with other secrets management tools
How a vault for AI agents differs from infrastructure tools.
Open
Secrets how-to FAQ
No. You can see the names and details you have access to. The values stay protected.
No. Keep AWS or HashiCorp for infrastructure. Use Joyst for the credentials your AI tools and agents use.
They refer to it by name. Controlled substitution supplies the value when it is used. This is designed to keep the key out of the prompt.
Add a secret. Stop pasting keys into chat.
Create an organisation account and bring skills, prompts, MCP servers, secrets and agents into one private catalogue.
- Private to your organisation
- Draft, then publish
- Limited open beta