API Vault
How buyers and creators save provider keys, and which key owner is billed in each workflow credential mode.
Buyers using their own provider keys and creators choosing a listing credential mode.
API Vault stores provider keys for the account that owns them. Keys stay server-side and are never placed in a public workflow graph, API response, event, stream, or client-side run payload.
Why it matters#
Without a central vault, keys get copied into individual blocks and become difficult to rotate safely. Vault gives each account one connection point per provider. A listing's credential mode determines whose Vault is used and who receives the provider bill.
Where you see it#
Vault appears in account settings and in builder or run preflight when a required provider is missing. Listing cards and product pages disclose the credential mode and required providers before a run.
In Workflow Studio, treat vault setup as part of configuring the block, not a separate chore.
The three credential modes#
| Listing mode | Credentials used | Who pays the provider | Buyer requirement |
|---|---|---|---|
| Edgaze-hosted | Edgaze platform credentials | Edgaze | No buyer provider key |
| Creator-connected | Listing creator's Vault keys | Creator | No buyer provider key |
| Buyer brings keys | Buyer's Vault keys | Buyer | Active Plus and every required provider key |
Credential requirements are determined by the workflow's listing-level credential mode. They are not inferred from which account happens to have a key saved.
Before creating a run, Edgaze checks every required provider. A missing or unreadable key stops preflight before wallet funds or a bundle run are reserved. Creator-connected listings become unavailable if the creator removes a required key; they never silently fall back to Edgaze-hosted credentials.
What creators should do#
Pick the model for the job and choose the listing credential mode before publishing. Creator-connected publication requires active Plus and all required creator Vault keys. Buyer-BYOK listings must clearly disclose the buyer's required providers.
Do not discover a missing key on launch day.
BYOK and billing#
In creator-connected and buyer-BYOK modes, Edgaze charges creator margin plus the displayed orchestration amount instead of hosted provider compute. The provider bills the credential owner directly. See BYOK.
Good habits#
- Keep keys only in vault.
- Match provider to model.
- Re-test after rotating or replacing a required key.
- Confirm the product page shows the intended credential mode before publishing.
What to read next#
Was this useful?
Your response helps us improve the documentation.
Related builder documentation
How Workflow Studio, Composer, Templates, and API Vault fit together in Edgaze.
Build, test, and publish your first Edgaze workflow without learning every block at once.
Build, publish, and integrate a workflow that turns a company website into a structured sales-research brief.