Project vault

The project vault holds keys that Coodoo needs, like a token for releases, access keys for your storage or an API key for an MCP server. Open the Project vault panel (on the right).

Storing a key

1. Click Add key.
2. Give it a name and paste the value.
3. Click Save in vault.

Replace puts in a new value, and Remove deletes it.

How safe is it?

• Keys are stored encrypted using your operating system's keychain.
• Once saved, you never see the value again, not even in Coodoo.
• The agents never get the values. A key you link to an MCP server or to your app goes only to that server or app, when it starts.
• If a value would still show up in text (a log, an error message), you see REDACTED instead.
• A commit that contains a vault value is refused; see Failsafes.

Where you use the vault

Anywhere Coodoo asks for a secret value, choose Pick from the vault… or create a new one right away with + New key in the vault…:

• in Release: tokens, storage keys and variables for the build;
• in MCP servers: environment variables and headers;
• in Your app's settings: the keys from your app's .env files, for example for your database or payment provider.

On more computers

If you work on the same project on more computers, the vault can come along without becoming readable anywhere. You find it at the bottom of the Project vault, under Between computers.

How it works

• Every computer has its own key pair. The secret part stays in that computer's keychain and goes nowhere.
• The vault goes to GitHub encrypted, in your own private repository coodoo-settings (see On all your computers), in the project's folder: settings/<owner>/<repo>/vault.enc. So it never ends up in the project itself, not even when that is public. Nothing on GitHub is readable, not even the names of keys.
• Did you already use the shared vault with an earlier version? Then it was on the coodoo-vault branch of the project. Coodoo moves it to coodoo-settings by itself. You may delete that old branch on GitHub yourself afterwards.
• Only computers you link yourself can open the vault.
• Every change is signed by the computer that made it. Coodoo only takes over changes from computers you approved. Someone who may write to coodoo-settings can't read the vault, and can't put keys of their own in it either.
• Changes go back and forth by themselves. If you change a key on two computers, the newest change wins. A removed key also disappears on your other computers.

The first computer

On the computer that already has your keys, click Share with my other computers.

Adding a computer

1. Open the project on the new computer and click Link this computer in the Project vault. A 16-digit code appears.
2. Open Coodoo on a computer that is already linked and go to the Project vault. The request is there, with a code.
3. Is it exactly the same code? Then click Code matches, approve. If the code is different, click Reject: someone else is trying to link their computer.

Within a minute the keys are on the new computer too.

Unlinking a computer

Click the unlink icon next to that computer. Coodoo makes a new vault key, so that computer can't open new versions. What it already had, it still has. If the computer is lost or can't be trusted, also replace the real keys at the services themselves.

Moving it once, without GitHub

With Export Coodoo makes a file encrypted with a 24-character passphrase. Coodoo makes up that passphrase itself. Write it down or keep it in your password manager, because the file can't be opened without it. Move the file to your other computer by USB or AirDrop. There you choose Import, fill in the passphrase and choose the file.