Secrets and the vault
Toys name vault slots, never key values; your keys stay in the account vault and are used only by the server.
Some nodes need a key: an LLM chat uses your Anthropic, OpenAI or Gemini key, and a Web request may call a service with yours. Tune.Toys keeps those keys out of Toys entirely.
Slots, not values#
A Toy stores only a slot name, such as secret:openai. The compiler turns it into a requirement, so the Play surface shows a "needs a key" chip before anything runs. Toys, takes, exports and logs never contain a key, and sharing or remixing a Toy never shares one: whoever opens it fills the slot with their own.
Slot names come from the addon catalog (anthropic, openai, gemini …) or are any other short name you choose, such as my-weather. A catalog slot is only ever sent to its addon's hosts; any other slot only to hosts in your own network allowlist.
The vault#
Settings → Vault stores keys in your account. You paste a key once; afterwards the app shows only its slot, label, first four and last four characters, and when it was last used. You can rotate or remove it at any time, and each change is noted in your inbox.
Keys are encrypted on the server with a key per account and bound to their slot. Only the API decrypts one, in memory, for the single upstream call that needs it, inside the request proxy or the LLM endpoint. Upstream errors are scrubbed of the key before they reach you, and upstream calls are logged by host, status, size and duration only.
The device vault#
Signed out, you can keep a key in this browser's device vault for addons whose service accepts direct browser calls. A key on the device can be read by anything that runs in the page, so the vault page says so plainly and recommends signing in. The proxy and the LLM endpoint always use the account vault.
Connections#
Connected services such as Google Drive are not keys. They are separate grants made through the service's own consent screen, stored sealed on the server and used through the connection routes; a Dataset with Source Connection requires one, and a Toy never contains the connection.