Vault & externals

To add a secret to the vault, open a project in Flow, choose Vault in the sidebar, then Add Secret. Add Secret in the dialog stays disabled until the secret has a name, a value and, for a PIN or password, a valid one.

• Secret Name: what the secret is for, like Production API Key.
• Type: Password, API Key, Database, OAuth, SMTP, Certificate, SSH Key or Other. New secrets are a Password.
• Secret Value: the secret itself. For an API Key the field is called API Key. It's hidden as you type, and the eye icon shows what you typed.
• URL / Endpoint and Notes: optional. Everyone in the project can read them, so keep secrets out of them.
• Unlock With: PIN (the default, 4 to 8 digits), Password (at least 8 characters) or Passkey, where each person confirms with a passkey of their own.

Flow can't show a PIN or password again once it's set, so share it with the people who need it some other way.

Flow encrypts a secret's value as soon as you save it. The vault list never includes the value: Flow decrypts it only for someone who is allowed to open the secret and passes its check, and shows it only in that person's Access Secret dialog.

• PIN and Password are checked by Flow's server, not in your browser, and Flow keeps only a scrambled form of them.
• Passkey asks each person to confirm with a passkey registered to their own account, so there's no shared code to pass around.
• After 5 wrong PIN or password attempts in a row, that person can't try that secret again for 15 minutes. Nobody else is affected.
• Every open, wrong attempt and lockout is recorded in the secret's Access History and in the project's Logs.
• Removing a secret destroys its stored value.

To open a secret, choose Access on its card.

• For a PIN or password, enter it and choose Access Secret. A wrong one shows how many attempts are left before the secret locks for you.
• For a passkey, choose Use passkey and confirm on your device. If you don't have a passkey yet, Flow offers Add a passkey.

The value appears in the dialog, and the copy icon beside it copies it. Closing the dialog hides it again.

Access is unavailable when you aren't allowed to open the secret, when it has no saved value, or when no PIN or password is set yet. Hover over it to see which. Your browser needs passkey support to open a passkey secret.

Each secret has managers: the person who added it, the person who created the project, and your organization's owners. Only managers can edit, duplicate, remove or change access to a secret. Someone who leaves the organization stops being a manager.

To choose who can open a secret, choose Access Control in its ⋯ menu, pick an option under Who Can Open It, then choose Save Changes:

• Everyone in the project: the default.
• Managers only.
• Specific people: managers, plus the people you add by email under People. Type an address and press Enter or choose Add, and the × beside an address removes it. You need at least one address to save.

Everyone in the project still sees the secret's card, but Access stays unavailable to people it doesn't include. Whoever opens it still needs its PIN, password or their own passkey. A restricted secret shows Managers only or Specific people on its card.

Access History, in the same dialog, lists the latest 50 opens, wrong attempts and lockouts, with each person's email, how they unlocked it and when. Only managers see it, and it can't be edited or deleted.

To add a passkey, choose Passkeys at the top of the Vault. In Your Passkeys, optionally type a New passkey name, like the device it's on, then choose Add passkey and follow your browser's prompt.

For your security, you can add a passkey only within 15 minutes of signing in. If Flow says to sign in again, sign out, sign back in, then add it.

A passkey belongs to your account, so it works for every passkey secret you're allowed to open, in any project. Your Passkeys lists each one with when you added it and last used it. To remove one, choose the trash icon beside it, then Remove.

The figures across the top of the vault count the project's secrets: Total secrets, Passwords, API keys and Restricted (secrets not open to everyone in the project, with how many are opened by passkey). Search and filters don't change them.

Narrow the list with the type filter (All Types by default), or search secret names and notes. Each card shows the secret's name, its URL, the start of its notes, and how it's unlocked: PIN, Password or Passkey. When you open the vault, the most recently changed secrets come first.

The vault shows the project's default number of secrets a page, 10 unless someone changed it under Settings → General → Default rows per page. Switch to 10, 25, 50 or 100 at the bottom.

A secret's managers see a ⋯ menu on its card:

• Edit opens the secret's form. The stored value and PIN or password are never shown: leave Secret Value blank to keep the value, and the PIN or password blank to keep it. Switching Unlock With to a PIN or password needs a new one. Choose Save Changes to keep your edits.
• Duplicate adds a copy with (Copy) after its name, with the same value, unlock method, PIN or password, and access. You become a manager of the copy.
• Access Control sets who can open it.
• Remove asks you to confirm, then destroys the secret and its value. A removed secret can't be restored from Flow.

Adding, changing and removing a secret is recorded in the project's Logs. The entry never includes the value, PIN or password.

Externals, in the project sidebar, holds links to the outside services the project uses, like its docs, status page or repository. To add an external link, choose Create external. Name and URL are required, and Flow adds https:// to an address that doesn't start with http:// or https://.

• Icon: External link (the default), Link, Docs, Status, Support, File, GitHub, Database or Help.
• Text color: the color of the link's icon and name. It starts gray.
• Show on top bar: puts the link's icon in the project's top bar. On by default.
• Open in new tab: opens the link in a new browser tab instead of in place of Flow. On by default.

Choose Save external to add the link.

The project's top bar shows the icons of up to 4 external links that have Show on top bar on, the most recently added ones. Hover over an icon to see the link's name, and click it to open the link. On narrow windows, the top bar leaves them out.

On the Externals page, click a link's row to open it. The figures across the top count every link, and how many show on the top bar or open in a new tab. Search matches names and URLs, and the All Placements filter narrows the list to links on the top bar or links that open in a new tab.

External links can't be edited. To change one, delete it and add it again. To delete a link, choose Delete in its ⋯ menu. Flow asks you to confirm first, and a deleted link can't be restored from Flow.