Vault

The codai Vault is the password and passkey manager built into codai. It stores logins, passkeys, API keys, notes and other secrets, syncs them between your devices, offers them to other apps, and lets an agent use a credential through a handle without seeing its value.

You create the vault once in the hub, at hub.codai.ro/vault, and then open it on your other devices.

What works whereCopy Anchor Link

The codai app from Google Play does not include the vault: its Vault screen points you to the hub and to the desktop app. A Wear OS watch can approve standard agent requests.

What codai can and cannot seeCopy Anchor Link

Every item is encrypted on your device before it is uploaded: in your browser when you use the hub, inside the app on desktop, Android and iPhone. The key that opens the vault is derived on the device from your vault password and your Secret Key. Neither of them is sent to codai. codai's servers store the encrypted items and deliver them to your devices.

codai cannot read:

• the content of an item: title, username, password, websites, notes, tags, files and the private key of a passkey;
• the names of your vaults;
• your vault password, your Secret Key and your recovery code.

codai can read, because it is stored unencrypted next to each item so that sync and agents work:

• the type of each item (login, passkey and so on), a version counter, and when the item was created, changed, last used and deleted;
• whether an item is marked as a honeytoken;
• for an item you expose to agents: its handle, the name you chose to show to agents, the sensitivity, the allowed hosts and the name of the environment variable;
• every agent request and your answer to it: the agent, the item, the host, the command or call it wants to make and the purpose it gave. This is the activity log. Values are never part of it;
• the devices you enrolled for approvals, and who is a member of a shared vault.

The exception: items usable in the cloudCopy Anchor Link

An item can get a second copy that codai's servers can open. For that, a device sends the decrypted item once, over an encrypted connection, and the server seals it at once with a key held by codai. With that copy the servers can use the item for your agents while none of your devices is unlocked. They open it only after your policy allowed the request.

• It is off by default, and it is decided item by item.
• Only the owner of the vault can turn it on.
• No codai app has a switch for it today. It is set through the API (PUT /v1/vault/items/{id}/cloud) or the SDKs.
• The hub marks such an item Usable in the cloud, and the Activity tab records Cloud use enabled and Cloud use disabled.
• The copy is removed when you delete the item and every time its content changes. The desktop and Android apps send a new copy after an edit. The hub and the iPhone app do not, so an edit made there turns cloud use off for that item.

For an item with a cloud copy, codai is technically able to read the content. For every other item it is not.

Without a cloud copy, an agent can use an item only through a codai app on your own machine: the desktop app with the vault unlocked, or codaid on a machine you enrolled. That app decrypts the item locally and hands the value to the command, not to the agent.

Good to knowCopy Anchor Link

• Nobody can reset your vault password. If you lose the password, the Secret Key and the recovery code, the vault cannot be opened by anyone. See Set up your vault.
• Locking. The hub locks after 10 minutes without activity or 5 minutes in a hidden tab. The desktop app locks after 15 minutes without use. The Android app locks 5 minutes after it goes to the background, the iPhone app as soon as it does.
• Clipboard. A copied secret is cleared from the clipboard after 30 seconds in the hub, on desktop and on Android, and after 60 seconds on iPhone.
• Breach check. The check on the Health tab hashes each password on your device and sends only the first 5 characters of the hash.