Set up your vault
Create the codai Vault in the hub, choose a vault password, save the Secret Key and the recovery kit, and know what each of them opens and what happens when one is lost.
You create the vault in the hub, in a browser. The desktop app, the Android app and the iPhone app cannot create one: they show a link to the hub and open the vault after it exists.
Create the vault
Open the vault page
Sign in at hub.codai.ro/vault. The page loads the encryption code into the browser first. If you see Encryption could not load, the browser blocked WebAssembly: update it or use another browser.
Choose the vault password
Under Create your vault, type a Vault password and repeat it in Confirm password. The strength meter has to reach 50 bits, which is about four random words. Create vault stays disabled until then.
This is not your codai account password. It never leaves the browser, and codai cannot reset it.
Save the recovery kit
The next screen, Save your recovery kit, shows three values that were just generated in your browser:
- Secret Key: starts with
CV1-. You type it once on every new device, together with the vault password. - Recovery code: opens the vault when you forget the password.
- Fingerprint: a short code that identifies your vault keys. It is not a secret.
Save the kit with Download kit (printable), Download as text, Print or Copy kit. The kit lists your account e-mail, the Secret Key, the recovery code, the fingerprint and the date, and has an empty line where you can write the vault password by hand. It is created in the browser and is not uploaded.
Confirm and open
Type the Last 4 characters of the Secret Key, read from the copy you saved, then choose Open my vault. Only now is the vault stored in your account. If you close the page before this step, nothing was created and you start again with new keys.
The kit is shown once
codai does not keep the Secret Key or the recovery code. After this screen they exist only in the copy you saved.
What each secret opens
| You have | What it opens |
|---|---|
| Vault password and Secret Key | The vault in the hub, and the first unlock on a new device. |
| Recovery code | The vault in the hub (Recovery code tab of the unlock form), without the password or the Secret Key. |
| A device you already set up | The vault on that device, with fingerprint, face, Windows Hello or the device PIN. |
| Your codai account password on its own | Nothing in the vault. |
All of them work only for someone who is signed in to your codai account, because the encrypted vault is delivered to signed-in devices only.
The recovery code is as powerful as the password and the Secret Key together. Keep the kit offline: printed, or in a place that is not your codai account.
The Secret Key in the hub
The unlock form in the hub asks for the vault password and the Secret Key every time. Remember the Secret Key on this device stores the key in that browser, so that you type only the password. Anyone who uses that browser profile then needs only your vault password. Leave it off on a shared computer.
If you lose something
| Lost | What to do |
|---|---|
| The vault password | In the hub, unlock with the Recovery code tab, then set a new password under Settings. You get a new Secret Key, a new recovery code and a new kit. See Export, password and Secret Key. |
| The Secret Key | A browser that remembers it still unlocks with the password: change the password there and create a new Secret Key. Otherwise unlock with the recovery code and do the same. |
| The recovery code | The vault still opens with the password and the Secret Key. Change the vault password in the hub: every password change creates a new recovery code and a new kit. See Export, password and Secret Key. |
| Password, Secret Key and recovery code | A device you already set up keeps opening the vault with its fingerprint, face or Windows Hello. You cannot open the vault in the hub or add a device. Copy what you need out of the vault while that device still opens it. |
| All of the above, and no device that opens the vault | Nobody can open the vault, codai included. The encrypted data cannot be read without one of these secrets. |
Do not rely on a single phone. On an iPhone, adding a new face or fingerprint removes the Face ID unlock and the app asks for the vault password and the Secret Key again.
Next
Vault
The codai Vault keeps passwords, passkeys, API keys and other secrets encrypted on your devices and lets agents use them without seeing the values. This page says what works where and what codai can and cannot see.
Add a second device
Open your codai Vault on the Windows desktop app, on Android, on iPhone and in a terminal. For each one, how you unlock, which items you can add and edit there, and what is missing.