Vault

The vault keeps credentials, such as a supplier’s API token, for your company’s own sites and bots. When a site’s server function or a bot asks for a credential by name to call that API, Fluid adds the credential to the request. The value never reaches the site’s code or the bot, and nobody can view it after you save it.

Where to find it

In the admin, click the Settings gear in the top bar. In the Settings sidebar, under System, select Vault. To open the screen, your role needs the Application Themes switch Customize and edit theme settings. On the Roles screen, Application Themes is in the Content & Website card.

What’s on the screen

The Add credential button is in the page header. Below it, a table lists your credentials:

• Name: the name a site or bot uses to ask for the credential.
• Base URL: the API the credential may be sent to.
• Header: the request header that carries the value.
• Path prefixes: the paths on that API that get the value.
• Methods: the request methods that get the value.
• Sites and Bots: how many sites and bots may use the credential.
• Last used: when a site or bot last used it, or Never.

The table never shows a value. Each row has Edit and Remove buttons.

Add a credential

1. Click Add credential.
2. Enter a Name, such as supplier-api. Use lowercase letters, numbers, hyphens and underscores, starting with a letter or number, up to 64 characters. You can’t change the name later.
3. Enter the Value, such as the API token. It’s write-only, so copy it from its source, not from Fluid, if you need it again.
4. Enter the Base URL, such as https://api.example.com. It must start with https:// and can’t hold a user name, a query or a fragment.
5. Check Header. It starts as Authorization. In Value prefix, add any text that goes before the value, such as Bearer .
6. In Path prefixes, enter up to 20 paths, one per line, each starting with /, such as /v1/. Only requests to a matching path get the value.
7. Under Methods, choose at least one of GET, POST, PUT, PATCH and DELETE. Only requests with a chosen method get the value.
8. Under Sites and Bots, choose who may use the credential. You can also add a site or bot by its ID. Leave a list empty to let no site, or no bot, use it.
9. Click Add.

Only your company’s own sites can use a credential. A member’s own site can’t.

Edit or remove a credential

Click Edit on a credential’s row to change its settings. The Value field is always blank. Leave it blank to keep the current value, or enter a new value to replace it. Click Save changes. If someone else changed the credential while you had it open, the save is refused. Close the dialog and open it again to see the current settings. Click Remove to delete a credential. Fluid asks you to confirm first. Sites and bots that used it stop getting it on their requests, and you can’t undo this.

How bots use the vault

When a bot’s request names a secret that isn’t one of the bot’s own, Fluid uses the vault credential of that name, if the credential lists the bot. The bot’s own secrets always come first. Listing a bot on a credential also approves the credential’s base URL for that bot, so the bot doesn’t ask for approval before it calls that API. Fluid sends the value only on requests that match the credential’s base URL, path prefixes and methods. It refuses a request that doesn’t match, and an answer that repeats the credential’s value back.

Need help?