Guide

Grok Bot Vault: logins, cards, and API keys kept out of chat

By Atlas AI Resources · Published October 29, 2026

Bots that sign in to websites and check out for you need passwords and cards. Grok Bot’s answer is Vault, Secure Forms, and a secure secret card, which fill values into the page without showing them to the Bot. This page starts with our own checklist, then summarizes what SpaceXSI’s docs page Vault and secure sign-in and related docs say.

1. Our advice: decide your card rule before you save a card

Sections 1 to 3 are our own advice, not SpaceXSI’s. Start with the one setting that changes what your Bots can spend.

Know what a saved card means. Per the docs, a card saved in Vault fills in at checkout without asking you each time, and no setting requires your approval for each use.
If you want to approve every payment, don’t save the card. That is the docs’ own advice. When a Bot asks for a card with a Secure Form, leave Securely save to Bot’s vault unchecked so the card is used only in that chat.
Watch for forms without the checkbox. Per the docs, a form without that checkbox saves straight to Vault. If you didn’t mean to save the card, don’t submit it.
Add an Ask first rule anyway. For example: “Ask first before any purchase or checkout.” Rules are plain language checked by a model-based review, so treat the rule as a second layer, not a lock. Not saving the card is the boundary the docs give.
Consider a one-time card. Per the docs, with a Link account connected a Bot can ask you to approve a one-time card for a single purchase, and the request shows the merchant, the items, and the total.

2. Our advice: a setup checklist

Save only logins every Bot may use. Vault covers your whole account, and you can’t limit an item to one Bot. If only one Bot should reach a site, keep that login out of Vault and enter it with a Secure Form when needed (leave the save box unchecked).
Write Hints. “Use for work purchases” or “Personal account, not for client work.” Per the docs, a Bot follows the hint when it chooses between entries.
Import, then delete the export. If you move logins from a password manager with a CSV export, delete the CSV once the import finishes. The docs warn that the export holds your passwords unencrypted.
Keep secrets out of chat, Shell, files, and demonstrations. Use the secure secret card for API keys. Don’t type a password while you record a task with Teach a task.
Check what it saved about you. When you give a Bot a name, address, phone number, or email, it saves it as contact info after the task and tells you. Say so if you don’t want it kept.
Prune once a month. Open Settings → Vault and remove logins and cards your Bots no longer need. After you remove a card, Grok Bot can no longer pay with it.

3. Our advice: a sign-in brief you can paste

Give the Bot the order of steps and the stop point up front. Adapt the site and task:

Task: “Sign in to example.com and download last month’s invoice.”
Sign-in: “Use the saved Vault login. If there isn’t one, ask me with a Secure Form. Never ask me to type a password in chat.”
Hand-off: “If you hit single sign-on, a passkey, a CAPTCHA, or a code on another device, hand me the computer for that step only.”
Stop point: “Don’t buy, renew, or change anything. If a payment comes up, stop and show me the merchant, the items, and the total.”

4. Per the docs: what Vault holds

Per Vault and secure sign-in:

Three kinds of items. Logins (a website, a username or email, and a password), cards (number, expiry, security code, name on card, and billing address), and contact info (names, addresses, phone numbers, and emails for shipping and billing).
Where it lives. Settings → Vault, in the desktop app or on your phone. Vault needs Grok Bot 0.75.2 or later.
What a Bot can see. A Bot never sees a saved password, card number, or security code. It can see your contact info and which logins you saved, so it can pick the right entry.
Account-wide. Everything you save is available to every Bot on your account. Vault isn’t supported on shared Bots; those use Secrets instead (section 6).
Adding items. Choose New item, then Login, Card, or Contact info. A card can be filled with Scan with camera or Upload a photo. You can also save from a chat with the Secure Form checkbox, and attaching a photo of a card offers Save to Vault.
Importing. On desktop, New item → Import from CSV… accepts exports from 1Password, Chrome or Edge, Safari or Apple Passwords, Firefox, Bitwarden, or LastPass. The file is read on your computer, never uploaded, and must be under 5 MB. Items already in Vault are skipped, and rows with errors (such as a missing password or a website that isn’t https) aren’t imported.
What only you can change. A Bot can change contact info, nicknames, and hints when you ask. Passwords, usernames, websites, card numbers, and security codes change only in Settings → Vault, and logins and cards are removed only there. On the phone, saved cards can’t be edited yet.

5. Per the docs: how a Bot signs in

The order. A Bot uses a login saved in Vault first, then a connected password manager such as 1Password, then asks you with a Secure Form. Values from Vault and Secure Forms are filled into the page without the Bot seeing them.
One-time codes. When a site emails a code, the Bot can read it from a connected Gmail or Outlook account or from its own inbox.
New accounts. If you let a Bot choose the password when it signs up for a site, Vault generates the password and saves the login, and the Bot never sees it.
Secure Forms. One form per step, naming the site it fills (“Never shown to your Bot. Filled directly to example.com.”). A filled form says the secret values were never shown to the Bot. If it says Could not fill into the page, submit a new form when the Bot asks again.
When you take over. Single sign-on, a passkey, a CAPTCHA the Bot couldn’t get past, an approval on another device, a QR code, or a bank card verification. Choose Take over (or Take control on the computer), complete only that step, choose I’m done, and tell the Bot to continue. The signed-in session stays on the computer and is shared across your Bots.
1Password. Per Use the computer and apps, you connect it under Connect apps → Password Managers and approve each login in 1Password, which fills it in. The new integration is rolling out gradually, works with personal and Family accounts, needs 1Password 8.12.42 or later, offers logins only from your Personal (Private) vault, and does not fill payment cards.

6. Per the docs: API keys and other secrets

Secure secret card. For an API key or any secret that isn’t a login or card, use the secure secret card when a Bot asks. The field is masked; after Save securely the value isn’t written into the chat or shown to the Bot. The approvals docs add that it is excluded from the transcript.
Shared Bots. On a shared Bot you own or manage, open Secrets → Add secret and enter an environment variable name, a short description, and the value. The Bot sees the description, not the value. Secrets on a shared Bot are used in every teammate’s chat, so only add keys you’re happy for everyone who can chat with it to use.
Team Secrets. A credential your company’s setup scripts need is stored by a team admin as a Team Secret on the Enterprise dashboard. Those never reach your Bots directly.
Write-only. Saved passwords stay hidden and cards show only their last four digits. To change a shared Bot secret, choose Replace; you can’t read the old value back. A blank field later is not proof the secret was deleted.
Recover and Reset. These and computer updates remove installed apps and packages, so a secret you typed into a file, a shell profile, or an installed tool can disappear. Secrets saved with the secure card, under Secrets, or in Vault are separate.

7. Per the docs: paying for things

Saved cards fill in at checkout, and contact info fills shipping and billing details.
Settings → Vault also lists Payment accounts (wallets such as Link or X Money) and a Default payment method, which Grok Bot pays with first.
With Link connected, a one-time card request shows the merchant, the items, and the total. Choose Pay to approve, Pay another way, or Deny, then finish on the Link page that opens. Nothing is charged if you decline or the request expires.

8. Keep consequential actions behind your yes

Grok Bot’s guardrails are plain-language rules checked by a separate review agent, not code. The current docs put them in Settings → General → Auto-review, as Ask first and Allow automatically rules (the 101 guide calls this Settings > General > Agent, with allow and block lists steering the reviewer). Per Approvals, security, and privacy, purchases and financial transfers are among the actions they prefer explicit boundaries for, Auto Review should complement least privilege rather than replace it, and if both kinds of rule match, Ask first wins.

The 101 guide also puts it plainly: if you log into a store on a computer the agent can use, “it can technically buy whatever it wants, the same way a human could.” A saved card or a signed-in session is access for every Bot on your account. Our advice: give that access the way you would to a new hire, a little at a time. Treat pages and emails a Bot reads as content, not orders; see keeping AI agents safe from prompt injection.

Useful public resources

SpaceXSI docs: Vault and secure sign-in

What Vault holds, importing logins, Secure Forms, the secure secret card, and paying for things.

SpaceXSI docs: Approvals, security, and privacy

Boundaries in the request, Auto-review rules, and keeping passwords and payment details out of chat.

SpaceXSI docs: Use the computer and apps

Taking over for a sensitive step, shared sign-ins, and connecting 1Password.

SpaceXSI docs: Shared Bots

Whose apps and secrets a shared Bot uses when teammates chat with it.

Cursor Help: Store secrets securely

The same Vault and secrets guidance in question-and-answer form.