The Vault
The Vault is where every secret Orbit touches lives: provider API keys, deploy tokens, database connection strings, the mobile shared secret. It is local and encrypted, and it never leaves your machine for Sivants’ servers.
Local and encrypted
Section titled “Local and encrypted”Secrets are stored with AES-256-GCM encryption at rest and decrypted locally — in the Electron app’s main process — when needed. Because decryption is local, the Vault works even when the Orbit server is off. You reach it from the key icon in the left sidebar or under Settings → Vault, which presents a two-tab Secrets and Backups interface with timed reveal, backup health, and a recovery phrase.
Scoping
Section titled “Scoping”A secret can be global (available to every project) or scoped to a specific project, and when both exist for the same service, the project scope wins. This lets you keep, say, a shared Anthropic key globally while giving one client project its own isolated credentials.
The service registry
Section titled “The service registry”Orbit maps your vault keys to the MCP server URLs of known services. Under Settings → Integrations, a connected service shows either “MCP Available” with a Copy URL action or “Built-in Tools,” and an unconfigured one shows an Add Key prompt — so the Vault doubles as the control panel for which integrations are live.
How BYOK uses it
Section titled “How BYOK uses it”When you store your own provider key in the Vault, that provider’s usage bypasses Sivants Credits entirely. Keys in the Vault are the mechanism behind bring-your-own-key — see Credits & BYOK.