Delete and undo
What happens when you delete an item from the codai Vault. The Undo window on each device, when the delete reaches your other devices, how long codai keeps the encrypted data, and how the duplicate passkey clean-up picks the copy to keep.
Deleting an item removes it from the vault on every device, and agents lose access to it at once. For a short time after you confirm you can still take the delete back. After that there is no trash and no restore.
Delete an item
Every surface asks you to confirm, and checks that it is you:
| Where | Confirm | Check |
|---|---|---|
| Hub | Delete, then Delete item in "Delete “…” from every device?" | A sign-in to codai that is less than 15 minutes old |
| Desktop | Delete on the item row, then confirm | Windows Hello |
| Android | Delete in the item sheet, then confirm | Fingerprint or face |
| iPhone | Delete (swipe the row, or the menu of the item), then confirm | Face ID, Touch ID or the passcode |
In a shared vault you need the Editor role or higher.
The Undo window
After you confirm, the item disappears from the list and a bar shows that it is deleted, how many seconds are left and an Undo button. Nothing has been sent yet.
- You have 10 seconds.
- On Android and iPhone you have 30 seconds when a screen reader (TalkBack, VoiceOver) is on, and the countdown stops while Undo is selected.
- In the hub and in the desktop app the countdown stops while the Undo button has keyboard focus or the pointer is over it. In the hub the bar sits at the top of the vault, above the tabs. In the desktop app it takes the place of the item's row.
- In the hub,
Ctrl+Z(Cmd+Zon a Mac) also undoes the delete, from anywhere outside a text field. - Undo puts the item back. Nothing was deleted.
The window ends early, and the delete is sent, when you:
- delete a second item in the hub or in a phone app (the first one is sent at once, its Undo is gone);
- lock the vault or leave the Vault page, in the hub, in the desktop app and on iPhone;
- send the phone app to the background;
- reload the hub page or go to another site. The hub sends the delete as the page goes away.
In the desktop and phone apps, a delete you confirmed is not lost when the app closes or the connection drops inside the window. The app keeps the id of the item, not its content, and sends the delete the next time the vault is opened on that device. The Android app tells you when a delete is waiting for the connection.
The hub can do this only in the same browser tab and within 15 minutes. If you close the tab during the window, the delete may not have been sent: open the vault again and check that the item is gone.
After the window
- The item is gone from the vault. Your other devices drop it at their next sync, see Vault troubleshooting.
- Agents lose access at once: the handle is removed and every access you approved for the item ends.
- A copy that was usable in the cloud is erased at once.
- The item stays deleted. A device that still shows an old copy cannot bring it back by saving it: the save is refused with a message that the item was deleted on another device.
What codai keeps, and for how long
For 30 days after the delete, the encrypted item is still stored on codai's servers. Nothing uses it: the apps never open a deleted item, and codai cannot decrypt it. A job that runs once a day then erases the encrypted content and its key.
What remains after that is an empty marker: the id of the item, its type and its dates. It tells a device that was offline for a long time that the item was deleted.
The activity log keeps the entry Item deleted.
Duplicate passkeys
A site sometimes ends up with several passkeys for the same account in your vault, for example after you registered twice. The Windows and Android pickers then show several entries for one account.
codai treats passkeys as duplicates when they have the same site and the same account. Passkeys without a site or without an account identifier are never grouped.
Where
- Hub: the Health tab, in the section that counts the duplicated passkeys.
- Desktop: Duplicate passkeys in the Vault tab.
- Android: Duplicate passkeys on the Health tab.
The iPhone app does not have this clean-up.
Which copy is kept
One copy of each group stays, the others are deleted.
- codai suggests the copy that was used most recently.
- When no copy was ever used, it suggests the newest one, by creation date.
- You can choose another copy before you confirm: under "Copy to keep" in the hub and in the desktop app, under Passkey to keep on Android. Each copy shows when it was created and when it was last used.
Check the copy that stays
Last used is recorded when codai signs a sign-in, also when the site then rejects it. The most recently used copy can be one the site no longer accepts. Before you remove the others, sign in to the site with the copy you want to keep.
Remove
Choose Remove … duplicates, confirm, and pass the same check as for a delete. The removal uses the same Undo window as a single delete: one bar, one Undo for the whole batch.
The kept passkey keeps working. The removed ones are deleted on every device, and they leave the Windows passkey list the next time the desktop app syncs or is unlocked.
Passwords and passkeys in other apps
Use the codai Vault as the password and passkey provider on Android and as the passkey provider on Windows 11. What each system version supports, how to turn codai on, and how to pick codai when another manager is offered first.
Agents and approvals
Let an agent use a credential from the codai Vault without seeing its value. Expose an item with a handle and allowed hosts, approve requests on your phone, watch, desktop or in the hub, and set decoy items that raise an alarm.