**Vault** holds the secret material for an environment: _"Manage environment API secrets and vault entries."_ It covers three related things — API keys your backend uses to call Authdog, encrypted values your workloads read, and the encryption keys that wrap them.

![Vault API keys](/content/console/vault.api-keys.png)

## Analytics

`?tab=analytics` — usage of the keys and secrets in this environment: which keys are being exercised, how often, and when each was last seen. A key with no recent activity is a candidate for revocation.

## API Keys

`?tab=api` — **"API access"**: _"Create scoped environment secrets for backend access."_

Click **"Add new"** to mint a key. Keys are scoped to the environment they were created in, so a `dev` key cannot read `prod` data. Empty environments read _"No secrets yet."_

Use these from server-side code to call the Authdog management and identity APIs. They are not for browsers — a public client uses the project and environment IDs from [Overview](/docs/console/overview) instead.

> **Caution**
>
> The key value is shown once, at creation. Copy it into your secret manager
> before closing the dialog. If it is lost, revoke the key and mint a new one.

## Secrets

`?tab=vault` — _"Store encrypted environment variables and secret values."_

Add a named entry with **"Add new"**; the value is encrypted at rest with the environment's default KMS key. This is where third-party credentials belong — a Stripe secret key, an SMTP password, a provider client secret — rather than in your own configuration files.

## KMS

`?tab=kms` — **"Key management (KMS)"**: _"Encryption keys for this environment. Secrets in the vault can be wrapped with a default key; decrypt and rotate using policies you attach to workloads."_

The table shows Name, Algorithm, DEK stored, Status, and Created. **"Add new"** creates a key and designates how new secret material is encrypted for the environment.

The page states the rotation contract plainly: _"Default keys apply to new encrypted secret material. Rotating a key marks the old material for re-wrap in the vault; plan a maintenance window before disabling a key that is still in use."_

> **Caution**
>
> Disabling a key that still wraps live secrets makes those secrets
> unreadable. Rotate first, let the re-wrap complete, then disable.

## How the three fit together

1. **KMS** defines the encryption keys.
2. **Secrets** stores values wrapped by the default key.
3. **API Keys** are the credentials your backend presents to read them.

## Related

| Read | To learn how to |
|------|-----------------|
| [Console overview](/docs/console/overview) | Find the project and environment IDs for public clients |
| [Authentication](/docs/console/authentication) | Manage OpenID clients and their secrets |
| [Sessions](/docs/console/sessions) | Rotate the JWT signing keys, which are managed separately |
| [Vault](/docs/vault) | Read and write secrets from application code |
| [Backend requests](/docs/backend) | Authenticate server-to-server calls |