The Vault

The Vault holds what lets your streamlines work on this device: your model key and your sign-ins to MCP servers. Open it from Vault, or, on this device before you have a key, from Add a Model Key at the top of the list.

Vault is a row of the sidebar on the Mac and the iPad, and of the list on the iPhone, and it belongs to the app rather than to one account. It lists every credential the device holds and where it is kept. When an organization is open, it starts with This session (who you are signed in as, how, and Sign Out) and Signed-in devices (each device signed in as you, with Sign Out for another one and Sign Out Everywhere). In the demo, This session offers Switch Person instead. If you are an admin or owner of that organization, Publishing shows one read-only line, Publishing key on this iPhone (approved by whom, waiting, or none), with Manage in Members: approving and revoking publishing keys happen in Members (Publishing from the app, AD-5). Organization model key comes next (below). Then, always, your Model keys and Sign-ins.

Your default key

Used by every streamline without a key of its own. It is kept in this device's Keychain and sent only to the model's provider with each request: never into a chat, never to the assistant, never to us.

1. Choose Add a Model Key and pick the Provider. Anthropic (Claude) works today; OpenAI, Google, Mistral and OpenAI-compatible servers are listed as coming.
2. Get a key from the provider (for Anthropic, console.anthropic.com → API keys).
3. Paste it into the field, or tap Paste to fill it from the clipboard, then Save. Spaces, line breaks and hidden characters picked up while copying are removed, and the app checks the key with the provider without spending anything.

If the check fails, the message says what the provider answered. Answered 401 means the provider doesn't know the key as sent: copy it again, and check it hasn't been disabled. A sign-in token from a Claude subscription or an admin key is not an API key, and the message says so. When the provider can't be reached, Save Anyway keeps the key; your first message will tell.

Later you can Replace Key or Remove Key. Removing it stops every streamline without a key of its own until you add one again.

A key per streamline

A streamline can have its own key, set at the foot of its editor in the Library under Own model key (optional), with Check and save. It shows that streamline's cost separately at the provider. Use the default key instead goes back. Save a new streamline first to give it a key. Under Model keys, the Vault lists each streamline with its own key, with Remove.

Your organization's model key (admins and owners)

Every organization brings its own model key: its streamlines use it for everyone's chats, and the bill and the data terms are the organization's. Admins and owners see Organization model key in the Vault (also reached from Settings → Accounts → Model Key); members don't see it.

1. Choose Add a Model Key (or Replace Key) and pick the Provider. Anthropic (Claude) works today.
2. Paste the organization's API key, or tap Paste, then Check and Save. It is cleaned the same way as your own key, checked with the provider, and stored encrypted by your organization's back end.
3. It is never shown again, to you or to anyone: the row shows the provider, the last four characters, and who set it when. Nothing is kept on this device.

If the provider doesn't accept the key, the message says what it answered (answered 401: copy it again). Remove Key asks first: every streamline that uses it stops answering until a key is added. Until a key is set, a chat says "Your organization hasn't added a model key yet." The demo's people can see the row but not change it. Your organization's own systems can set it too, with its server key (scripts/set-model-key.mjs).

Sync keys with iCloud

Off, your keys stay on this device. On, they go to iCloud Keychain, end-to-end encrypted, and appear on your other devices signed in to the same Apple ID. Turning it off stops syncing new changes; keys already on other devices stay there. Removing a key while sync is on removes it from your other devices too.

The same switch is in Settings → Accounts → On this device → iCloud, beside Sync streamlines with iCloud, Sync chats with iCloud (see Where your chats are kept, PR-3) and Sync organization list with iCloud (see Your accounts, GS-5). Each is set on each device. Keys never travel inside a streamline or a chat: a file or message that holds something shaped like a key is never sent to iCloud.

Sign-ins

Each MCP server you are signed in to, with Signed in 12 min ago, how long your last session lasted, and Sign Out. Systems rarely say how long a session lasts, so the last one's length is a hint for the next. Sign-ins stay on this device only; they never sync. Until a streamline asks you to sign in somewhere, it says None yet.