# WorkOS Vault

> Developer-friendly enterprise key management (EKM) to encrypt and optionally store tokens, passwords, certificates, files and other customer data.

- id: `workos-vault`
- category: Tools (`tools`)
- url: https://workos.com/docs/vault
- status: active
- tags: secrets, encryption, identity, byok
- llms.txt: https://workos.com/docs/llms.txt
- auth: api-key
- related: WorkOS AuthKit for MCP (https://indexagentica.com/entries/workos-authkit-mcp/)
- sources: https://workos.com/docs/vault.md , https://workos.com/docs/llms.txt
- added: 2026-10-14
- updated: 2026-10-14
- last verified: 2026-10-14
- featured in: Agent auth and delegated access, step by step (https://indexagentica.com/guides/agent-auth-and-delegated-access/)
- maintainer: WorkOS
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/workos-vault/
- json: https://indexagentica.com/api/entries/workos-vault.json

Each secret uses a unique encryption key and is isolated by user-provided context (envelope encryption with DEK/KEK); supports BYOK from your or your customers' cloud environments.