Vault
End-to-end encrypted credentials for your workspaces.
The vault stores your secrets (API keys, tokens, credentials) end-to-end encrypted. The hub only ever holds the ciphertext — it never sees your plaintext or your passphrase.
How it works
Set a passphrase
You set a master passphrase. Your secrets are encrypted client-side; the hub stores only the encrypted blob (zero-knowledge).
Seeded into the workspace
When a workspace starts, the hub seeds the encrypted blob into it. You unseal it locally with your passphrase — the plaintext only ever exists inside the workspace.
Use it
Secrets are available to your tools and the AI agent inside the workspace, and server-side provider keys are injected into AI calls so keys never go client-side.
Machine identities
For CI and agents that need a specific secret without your passphrase, issue a machine identity — a bearer token, optionally IP-scoped, that can read just the secrets you grant it via the Vault API.
Your passphrase is the only key. Motion cannot recover your vault if you lose it — that's the point of zero-knowledge encryption. Keep it safe.