> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.fabricgateway.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.fabricgateway.ai/_mcp/server.

# Manage credentials and vaults

> Manage the credentials that the gateway uses, and understand where secrets are stored on cloud and enterprise tenants.

**Credentials** holds the credentials that the gateway uses and issues for your connected services. A credential that you add lets the gateway authenticate to an imported REST API instead of passing each caller's own credentials through. **Vaults** are the credential backends that hold your secrets. This topic explains both, and how they differ between cloud and enterprise tenants.

## Prerequisites

Before you begin, make sure you have the following:

* Access to a Fabric AI Gateway organization. Members can see **Credentials**, and Super admins can see everything in **Admin**. For details, see [Manage users and invitations](/fabric/administration/users).
* A connected service that needs a credential. For the import workflow that this supports, see [Connect a REST API](/fabric/gateways/rest-apis).

## Understand credentials

Several kinds of credentials are involved when traffic passes through the gateway:

* **Gateway credentials** authenticate callers to a route. The setup wizard creates one when you select **Create a gateway credential**. Callers send the gateway key with each request. For setup and request examples, see [Authenticate requests with Key Auth](/fabric/plugins/key-auth).
* **Provider credentials** authenticate the gateway to a provider, such as an Anthropic API key. You enter the key when you connect the provider, and the gateway adds it when it proxies a request. For setup steps, see [Connect an LLM provider](/fabric/gateways/llm-providers).

To manage credentials, select **Credentials** in the sidebar.

## Understand vaults

A vault is a credential backend that the gateway uses to look up secrets. Sensitive fields stay on the data plane. The control plane stores only references to them. For more on vaults and other gateway terms, see [Key concepts](/get-started/concepts).

How you use vaults depends on your tenant:

| Tenant         | Vaults                                                                                                                                                            |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Cloud**      | You don't configure a vault. Fabric uses a Postman-managed vault in the background, and **Vaults** doesn't appear in the sidebar.                                 |
| **Enterprise** | You bring your own vault. The data plane runs in your cloud, so you can use the vault that already holds your secrets, and your secrets stay in your environment. |

For more about the two deployment models, see [Deployment options](/get-started/architecture#deployment-options).

## Review vaults

On an enterprise tenant, select **Vaults** under **Admin** to review your vaults. The table includes the following columns:

| Column          | What it shows                                                                                    |
| --------------- | ------------------------------------------------------------------------------------------------ |
| **Name**        | The vault's name, for example `aws-production-v2`.                                               |
| **Provider**    | The secret store that the vault uses, for example **AWS Secrets Manager**.                       |
| **Prefix**      | The path prefix under which the vault looks up secrets.                                          |
| **Cache TTL**   | How long the gateway caches values from the vault. The column shows a dash when no value is set. |
| **Auth fields** | The authentication fields that the vault requires, for example `region`.                         |
| **Actions**     | **Edit** and a trash icon for removing the vault.                                                |

Use **Search vaults** to find a vault, and select **Add** to add one.

## Next steps

* To connect a provider whose key the gateway stores, see [Connect an LLM provider](/fabric/gateways/llm-providers).
* To review who has access to your organization, see [Manage users and invitations](/fabric/administration/users).