# Add a second device (/docs/vault/devices) Open your codai Vault on the Windows desktop app, on Android, on iPhone and in a terminal. For each one, how you unlock, which items you can add and edit there, and what is missing. After you [created the vault in the hub](./set-up.mdx), every other device is added the same way: sign in to your codai account on it, open the vault, and type the **Vault password** and the **Secret Key** once. The device then keeps its own way to unlock (fingerprint, face, Windows Hello), so you do not type them again. Have the recovery kit at hand: the Secret Key is on it. **Needs:** Windows with Windows Hello set up (face, fingerprint or PIN), and the app signed in to your codai account. 1. Open the **Vault** tab. 2. Under **Turn on Windows Hello for the vault**, type the **Vault password** and the **Secret Key**, then choose **Turn on**. 3. From then on, choose **Unlock with Windows Hello**. Without Windows Hello the app shows "Windows Hello is not available on this device. Use the hub or codaid with your vault password." There is no password-only unlock in the desktop app, so the vault does not open in the desktop app on Linux. **What you can do** - **Add item** (`Ctrl+N`): **Login**, **Note** or **API key**, saved in the **Personal vault** or in a shared vault you may write to. - **Edit** a login, a note or an API key. Windows Hello asks first. - **Reveal** and **Copy**: Windows Hello asks every time. - **Delete** any item, with [Undo](./delete-undo.mdx). - Approve agent requests, see **Health**, clean up duplicate passkeys, and act as the [Windows passkey provider](./autofill-passkeys.mdx). **What is missing** - Creating the vault, import, export and changing the vault password: use the hub. - Editing other item types (cards, SSH keys, passkeys and so on). They are listed and can be deleted. - Exposing an item to agents: an item added here is not visible to agents until you expose it in the hub. The vault locks after 15 minutes without use. **Keep unlocked while codai is focused** stops the timer while the codai window is in front. **Needs:** the codai app installed from the [APK on GitHub](../apps/android.mdx), Android 11 or newer. The app from Google Play does not include the vault. Its Vault screen says "The vault is not included in the Google Play version of codai." and offers **Open hub.codai.ro/vault**. 1. Open the menu and choose **Vault**. 2. Type the **Vault password** and the **Secret Key**, then **Unlock**. 3. Confirm **Enable biometric unlock** with your fingerprint or face. Next time, choose **Unlock with biometrics**. Biometric unlock needs a fingerprint or face unlock that Android rates as strong. **What you can do** - **Add item**: **Login**, **Note** or **API key**. - **Edit** the same three types, after a fingerprint or face check. For a login: name, username, password, websites and apps, and the authenticator key (TOTP). - **Show** and **Copy**: a fingerprint or face check every time. - **Delete** any item, with [Undo](./delete-undo.mdx). - [Fill passwords and passkeys in other apps](./autofill-passkeys.mdx). - Approve agent requests after **Enrol this phone**, end live access, see **Health** and **Emergency**. **What is missing** - Creating the vault, import, export and changing the vault password: use the hub. - Editing other item types. Passkeys and the other types can only be deleted. - Exposing an item to agents. The vault locks 5 minutes after the app goes to the background. **Needs:** the [codai app for iPhone](../apps/ios.mdx), which is still in testing. 1. Open **More**, then **Vault**. 2. Type the **Vault password** and the **Secret Key**, then **Unlock**. 3. From then on, **Unlock with Face ID** (or **Unlock with Touch ID**). **What you can do** - **Add item**: **Login**, **Note** or **API key**. - **Edit** the same three types. For a login: name, username, password and websites. - **Reveal** and **Copy** a secret. - **Delete** any item, with [Undo](./delete-undo.mdx). - Approve standard agent requests after **Enable approvals on this iPhone**. Editing, deleting, revealing and copying a secret each ask for Face ID, Touch ID or the iPhone passcode first. **What is missing** - Filling passwords or passkeys in other apps and in Safari. - Health, emergency access and the duplicate passkey clean-up. - Approving high-risk requests: use an Android phone, the desktop app or the hub. - Creating the vault, import, export and changing the vault password: use the hub. The vault locks as soon as the app goes to the background. If you add a new face or fingerprint to the iPhone, the Face ID unlock is removed and the app asks for the vault password and the Secret Key again. **Needs:** [`codaid`](../apps/codaid.mdx) signed in on the machine. ```bash codaid vault enroll ``` The command asks for the **Vault password** and the **Secret Key**, then stores an unlock key for this machine in `~/.codai/vault-device.json`, a file only your user can read. After that `codaid` opens the vault without asking. **What you can do** - `codaid vault list`: the credentials you exposed to agents, as handles and hosts. Values are never printed. - `codaid vault run -- `: runs a command with handles replaced by the real values, and removes the values from its output. See [Agents and approvals](./agents.mdx). - `codaid vault add --title "…" --purpose "…"`: prints a link where you type a new secret in the hub or in the desktop app. The value is never typed in the terminal. - `codaid vault import `: imports `.env` files and exports of other password managers. Without `--apply` it only prints the plan. **What is missing** - Showing, editing or deleting an item. - A lock command: the unlock key stays in the file until you delete the file. - Approving agent requests: the key of a terminal can only fetch values for `codaid vault run`. Anyone who can read that file as your user can open the vault on that machine. Enrol only machines you control. ## The hub does more [#the-hub-does-more] The hub is the only place with every item type. **New item** offers **Login**, **API key**, **Environment (.env)**, **SSH key**, **OAuth token**, **Secure note**, **Card** and **Identity**. A **Passkey** or a **File** can be viewed and deleted in the hub, not edited. The type of an item is fixed when it is created. To change it, delete the item and create a new one. ## Check that it is the same vault [#check-that-it-is-the-same-vault] Every surface shows the **Fingerprint** of the vault: on the unlock form in the hub, in the desktop Vault tab, and after `codaid vault enroll`. It is the same short code everywhere, and the same one that is printed on your recovery kit. ## Remove a device [#remove-a-device] The **Devices** tab in the hub lists the devices that can approve agent requests. **Revoke** stops a device from approving at once. It does not remove the items that device already holds, so also sign the device out of your codai account under **Security → Devices**.