> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/openlit/openlit/llms.txt
> Use this file to discover all available pages before exploring further.
# Vault
> Centrally store and retrieve LLM API keys and other secrets without embedding them in code or environment variables
Vault is OpenLIT's secrets management system. Instead of embedding API keys like `OPENAI_API_KEY` directly in your code or distributing them via environment variables, you store them once in Vault and retrieve them at runtime from any application. This lets your team share secrets securely, rotate keys in one place, and avoid credentials spreading across repos and configs.
## Key features
* **Centralised storage** — create, edit, and manage secrets for all your applications from a single UI
* **Tag-based retrieval** — assign tags to secrets and fetch only the ones relevant to a given service
* **Environment injection** — automatically set fetched secrets as environment variables in your running process
* **SDK and API access** — retrieve secrets from Python, TypeScript, or any HTTP client
## Get started
Open OpenLIT and click **Vault** in the left navigation. The list view shows all secrets currently stored, along with their keys and tags.
1. Click **Create new** in the top-right corner.
2. Enter the **key** — this is the environment variable name your application expects (e.g. `OPENAI_API_KEY`).
3. Enter the **value** — the actual secret string.
4. Add one or more **tags** to group related secrets (e.g. `production`, `openai`). Tags let you fetch a filtered subset of secrets at runtime.
5. Click **Save**.
Secret values are stored encrypted. You cannot view a secret's value after saving — only update or delete it.
Your application needs an OpenLIT API key to authenticate requests to Vault.
1. In OpenLIT, navigate to **API Keys**.
2. Click **Create API Key**.
3. Enter a name, then click **Create**.
4. Copy the key and store it securely — you will not be able to view it again.
You can also set the API key via the `OPENLIT_API_KEY` environment variable so you do not have to pass it in every call.
Install the OpenLIT SDK if you have not already:
```bash theme={null}
pip install openlit
```
Fetch all secrets and optionally inject them as environment variables:
```python theme={null}
import openlit
response = openlit.get_secrets(
url="http://127.0.0.1:3000",
api_key="_OPENLIT_API_KEY",
should_set_env=True,
)
print(response)
```
```shell Output theme={null}
{
err: null,
res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
}
```
When `should_set_env` is `True`, each key in the response is also set as an environment variable in the current process — so subsequent calls to `os.environ["OPENAI_API_KEY"]` work without any additional code.
#### Python SDK parameters
Base URL of your OpenLIT instance. Defaults to the `OPENLIT_URL` environment variable.
OpenLIT API key for authentication. Defaults to the `OPENLIT_API_KEY` environment variable.
Fetch a single secret by its key (e.g. `OPENAI_API_KEY`). Omit to fetch all secrets.
Fetch only secrets that have all of the specified tags assigned.
When `True`, sets each returned secret as an environment variable in the current process.
Install the OpenLIT SDK:
```bash theme={null}
npm install openlit
```
Fetch secrets and inject them into your environment:
```typescript theme={null}
import Openlit from 'openlit';
const response = await Openlit.getSecrets({
shouldSetEnv: true,
});
console.log(response);
```
```shell Output theme={null}
{
err: null,
res: { ANTHROPIC_API_KEY: 'ANTHROPIC_API_VALUE', OPENAI_API_KEY: 'OPENAI_API_VALUE' }
}
```
#### TypeScript SDK parameters
Base URL of your OpenLIT instance. Defaults to the `OPENLIT_URL` environment variable or `http://127.0.0.1:3000`.
OpenLIT API key for authentication. Defaults to the `OPENLIT_API_KEY` environment variable.
Fetch a single secret by its key. Omit to fetch all secrets.
Fetch only secrets that have all of the specified tags assigned.
When `true`, sets each returned secret as an environment variable in the current process.
You can retrieve secrets directly over HTTP.
```bash theme={null}
curl --request POST \
--url http://127.0.0.1:3000/api/vault/get-secrets \
--header 'Authorization: Bearer _OPENLIT_API_KEY' \
--header 'Content-Type: application/json' \
--data '{}'
```
To fetch a single secret by key:
```bash theme={null}
curl --request POST \
--url http://127.0.0.1:3000/api/vault/get-secrets \
--header 'Authorization: Bearer _OPENLIT_API_KEY' \
--header 'Content-Type: application/json' \
--data '{"key": "OPENAI_API_KEY"}'
```
#### Request parameters
`Bearer ` — your OpenLIT API key.
Fetch a single secret by its key. Omit to fetch all secrets.
Fetch only secrets that have all of the specified tags assigned.
#### Response fields
`null` on success, or an error message string on failure.
A flat object where each key is the secret key and each value is the secret value. For example:
```json theme={null}
{
"ANTHROPIC_API_KEY": "ANTHROPIC_API_VALUE",
"OPENAI_API_KEY": "OPENAI_API_VALUE"
}
```
***
Create custom visualizations with flexible widgets, queries, and real-time AI monitoring
Version, deploy, and collaborate on prompts with centralized management and tracking
Compare cost, duration, and response tokens across different LLMs to find the most efficient model