Overview
Vault is Shield360’s built-in secrets manager for LLM API keys and other sensitive values. Instead of pasting an API key into every codebase, .env file, or teammate’s laptop, you store it once in Vault and let any application fetch it at runtime - decoupling key rotation from redeploys.
What you get
Section titled “What you get”Create, edit, tag, and delete secrets from the Vault list page
SecurityEncryption at rest, per-user access, and CORS for browser calls
Retrieve SecretsFetch secrets into your application with the Python or TypeScript SDK, or the REST API
Why Vault
Section titled “Why Vault”Vault has no direct built-in equivalent in most LLM observability tools - typically you’re expected to manage API keys yourself, through your own environment variables or a general-purpose secrets manager. Shield360 centralizes secrets so that any application (not just Shield360 itself) can fetch them at runtime through the SDK or API. That means rotating a key in Vault takes effect the next time an application fetches it - no restarts or redeploys required.
Vault secrets are also usable directly inside Shield360: the Evaluation configuration screen, the Chat settings screen, and OpenGround’s provider configuration all let you pick - or create on the spot - a Vault secret as their API key, instead of requiring you to visit the Vault page first.
Create custom visualizations with flexible widgets, queries, and real-time AI monitoring
Manage promptsVersion, deploy, and collaborate on prompts with centralized management and tracking
LLM playgroundCompare cost, duration, and response tokens across different LLMs to find the most efficient model
Frequently asked questions
Section titled “Frequently asked questions”What is Vault used for?
Vault centrally stores secrets like LLM API keys, encrypted at rest with AES-256-GCM, so applications can retrieve them remotely via SDK or API instead of embedding keys in code or environment files.
Can secrets be rotated without redeploying?
Yes. Since applications fetch secrets from Vault at runtime, rotating a key in Vault takes effect on the next fetch - no restarts or redeploys needed.
Is Vault safe to call from a browser?
Vault enforces API-key authentication and CORS. Browser-based cross-origin calls require adding your app’s origin to SHIELD360_ALLOWED_CORS_ORIGINS; server-to-server calls are unaffected.
Can I change a secret's Key after creating it, or view its Value later?
No to both, by design. A secret’s Key becomes read-only once it’s created - you’d need to create a new secret under a different Key instead. The Value is write-only: it’s never sent back to the browser, so the Value field is always blank when you open a secret to edit it. Leave it blank to keep the existing value, or type a new one to overwrite it.