---
id: FR-5
title: The Vault
group: On this device
summary: Your model keys, per-streamline keys, iCloud Keychain sync, and the systems you are signed in to
keywords: [vault, key, model key, organization model key, provider, anthropic, openai, api key, icloud, keychain, sync, sign-ins, sign out, 401, admin, owner]
---

The Vault holds what lets your streamlines work on this device: your model key and your sign-ins to MCP servers. Open it from **Vault**, or, on this device before you have a key, from **Add a Model Key** at the top of the list.

**Vault** is a row of the sidebar on the Mac and the iPad, and of the list on the iPhone, and it belongs to the app rather than to one account. It lists every credential the device holds and where it is kept. When an organization is open, it starts with **This session** (who you are signed in as, how, and **Sign Out**) and **Signed-in devices** (each device signed in as you, with **Sign Out** for another one and **Sign Out Everywhere**). In the demo, **This session** offers **Switch Person** instead. If you are an admin or owner of that organization, **Publishing** shows one read-only line, *Publishing key on this iPhone* (approved by whom, waiting, or none), with **Manage in Members**: approving and revoking publishing keys happen in Members (Publishing from the app, AD-5). **Organization model key** comes next (below). Then, always, your **Model keys** and **Sign-ins**.

## Your default key

*Used by every streamline without a key of its own.* It is kept in this device's Keychain and sent only to the model's provider with each request: never into a chat, never to the assistant, never to us.

1. Choose **Add a Model Key** and pick the **Provider**. Anthropic (Claude) works today; OpenAI, Google, Mistral and OpenAI-compatible servers are listed as coming.
2. Get a key from the provider (for Anthropic, console.anthropic.com → API keys).
3. Paste it into the field, or tap **Paste** to fill it from the clipboard, then **Save**. Spaces, line breaks and hidden characters picked up while copying are removed, and the app checks the key with the provider without spending anything.

If the check fails, the message says what the provider answered. *Answered 401* means the provider doesn't know the key as sent: copy it again, and check it hasn't been disabled. A sign-in token from a Claude subscription or an admin key is not an API key, and the message says so. When the provider can't be reached, **Save Anyway** keeps the key; your first message will tell.

Later you can **Replace Key** or **Remove Key**. Removing it stops every streamline without a key of its own until you add one again.

## A key per streamline

A streamline can have its own key, set at the foot of its editor in the Library under **Own model key (optional)**, with **Check and save**. It shows that streamline's cost separately at the provider. **Use the default key instead** goes back. Save a new streamline first to give it a key. Under **Model keys**, the Vault lists each streamline with its own key, with **Remove**.

## Your organization's model key (admins and owners)

Every organization brings its own model key: its streamlines use it for everyone's chats, and the bill and the data terms are the organization's. Admins and owners see **Organization model key** in the Vault (also reached from **Settings → Accounts → Model Key**); members don't see it.

1. Choose **Add a Model Key** (or **Replace Key**) and pick the **Provider**. Anthropic (Claude) works today.
2. Paste the organization's API key, or tap **Paste**, then **Check and Save**. It is cleaned the same way as your own key, checked with the provider, and stored encrypted by your organization's back end.
3. It is never shown again, to you or to anyone: the row shows the provider, the last four characters, and who set it when. Nothing is kept on this device.

If the provider doesn't accept the key, the message says what it answered (*answered 401*: copy it again). **Remove Key** asks first: every streamline that uses it stops answering until a key is added. Until a key is set, a chat says *"Your organization hasn't added a model key yet."* The demo's people can see the row but not change it. Your organization's own systems can set it too, with its server key (`scripts/set-model-key.mjs`).

## Sync keys with iCloud

Off, your keys stay on this device. On, they go to iCloud Keychain, end-to-end encrypted, and appear on your other devices signed in to the same Apple ID. Turning it off stops syncing new changes; keys already on other devices stay there. Removing a key while sync is on removes it from your other devices too.

The same switch is in **Settings → Accounts → On this device → iCloud**, beside **Sync streamlines with iCloud**, **Sync chats with iCloud** (see Where your chats are kept, PR-3) and **Sync organization list with iCloud** (see Your accounts, GS-5). Each is set on each device. Keys never travel inside a streamline or a chat: a file or message that holds something shaped like a key is never sent to iCloud.

## Sign-ins

Each MCP server you are signed in to, with *Signed in 12 min ago*, how long your last session lasted, and **Sign Out**. Systems rarely say how long a session lasts, so the last one's length is a hint for the next. *Sign-ins stay on this device only*; they never sync. Until a streamline asks you to sign in somewhere, it says *None yet*.