Manage credentials and vaults | Fabric Gateway Docs

Credentials holds the credentials that the gateway uses and issues for your connected services. A credential that you add lets the gateway authenticate to an imported REST API instead of passing each caller’s own credentials through. Vaults are the credential backends that hold your secrets. This topic explains both, and how they differ between cloud and enterprise tenants.

Prerequisites

Before you begin, make sure you have the following:

Access to a Fabric AI Gateway organization. Members can see Credentials, and Super admins can see everything in Admin. For details, see Manage users and invitations.
A connected service that needs a credential. For the import workflow that this supports, see Connect a REST API.

Understand credentials

Several kinds of credentials are involved when traffic passes through the gateway:

Gateway credentials authenticate callers to a route. The setup wizard creates one when you select Create a gateway credential. Callers send the gateway key with each request. For setup and request examples, see Authenticate requests with Key Auth.
Provider credentials authenticate the gateway to a provider, such as an Anthropic API key. You enter the key when you connect the provider, and the gateway adds it when it proxies a request. For setup steps, see Connect an LLM provider.

To manage credentials, select Credentials in the sidebar.

Understand vaults

A vault is a credential backend that the gateway uses to look up secrets. Sensitive fields stay on the data plane. The control plane stores only references to them. For more on vaults and other gateway terms, see Key concepts.

How you use vaults depends on your tenant:

Tenant	Vaults
Cloud	You don’t configure a vault. Fabric uses a Postman-managed vault in the background, and Vaults doesn’t appear in the sidebar.
Enterprise	You bring your own vault. The data plane runs in your cloud, so you can use the vault that already holds your secrets, and your secrets stay in your environment.

For more about the two deployment models, see Deployment options.

Review vaults

On an enterprise tenant, select Vaults under Admin to review your vaults. The table includes the following columns:

Column	What it shows
Name	The vault’s name, for example `aws-production-v2`.
Provider	The secret store that the vault uses, for example AWS Secrets Manager.
Prefix	The path prefix under which the vault looks up secrets.
Cache TTL	How long the gateway caches values from the vault. The column shows a dash when no value is set.
Auth fields	The authentication fields that the vault requires, for example `region`.
Actions	Edit and a trash icon for removing the vault.

Use Search vaults to find a vault, and select Add to add one.

Next steps

To connect a provider whose key the gateway stores, see Connect an LLM provider.
To review who has access to your organization, see Manage users and invitations.