Credential vault

Overview

Credential Vault lets your connections authenticate with secrets kept in your organization's own vault, instead of storing credentials in Leena AI. Leena AI reads a secret only when a connection is used and never stores or logs its value.

You can find Credential Vault under Integrations → Credential vault. Azure Key Vault is the supported provider. You connect a vault once, then link it to as many connections as you need.

Use Credential Vault when:

• Your security policy requires credentials to stay in a customer-owned vault.
• You rotate secrets regularly and want connections to pick up the new value with no change in Leena AI.
• Several connections share a credential and you want to manage it in one place.

How Credential Vault Works

Leena AI resolves vault secrets each time a connection runs, so the value in your vault is always the one used. If a referenced secret is missing, the run stops with a value not found error that names the secret and the field.

What Leena AI keeps and what it does not:

• Vault login: the Tenant ID, Client ID, client secret and Vault URL are stored encrypted in Leena AI.
• Access token: cached per vault and reused until shortly before it expires. A 401 or 403 from the vault clears it.
• Secret values: never stored, cached or logged. Execution logs show [vault:<field>] in their place.
• Rate limits: if Azure throttles a request, Leena AI retries after 1 second, then 2 seconds, then fails with a throttled error.

Prerequisites

Before you connect a vault, set up the following in Azure:

1. Register an app in Microsoft Entra ID and create a client secret for it. Copy the secret value, not the secret ID.
2. Note the Tenant ID (Entra ID → Overview) and the app's Application (client) ID.
3. Note the Vault URL from the Key Vault's Overview page, for example https://contoso-hr.vault.azure.net.
4. Give the app access to the vault's secrets:
   • List and get secrets, to read them. For example, the Key Vault Secrets User role.
   • Set secrets as well, if connections will store their whole config in the vault. For example, the Key Vault Secrets Officer role.

In Leena AI, you need the Admin role to connect a vault.

Creating a Vault

A vault is saved only after Leena AI signs in to it successfully, so a vault that appears in the list is one Leena AI can reach.

Steps

1. Go to Integrations → Credential vault and click Connect vault. If no vault exists yet, the page shows No sources connected with the same button.
2. Under Details, enter a Name and select Azure Key Vault as the provider. The Azure Key Vault fields appear.
3. Fill in the provider fields listed below.
4. Click Save.
5. On success you see Credential source connected! and the vault appears in the list as Active.

Fields

What happens when you save

Leena AI runs these checks in order and stops at the first failure:

1. Field validation. Required fields, the name format and the Vault URL pattern are checked in the form.
2. Unique name. A vault with the same name in the workspace is refused: A vault named "…" already exists.
3. Login test. Leena AI requests an access token from Microsoft Entra ID with the client credentials, then calls the vault to list secrets. If either step fails, the vault is not saved and you see Vault connection test failed: followed by the reason from Azure.
4. Save. The login details are encrypted and stored. The access token from the test is kept for this vault and reused until shortly before it expires. Secret values are never cached.

Linking a Vault to a Connection

A connection uses a vault through the Credential vault card on the first page of the connection form. The storage mode you pick decides what lives in the vault and what lives in Leena AI.

Steps

1. Open a connector and add a new connection, or edit an existing one.
2. On the first page, turn on the Credential vault switch.
3. In Associated vault, select a vault. Only active vaults are listed.
4. In Store config in, choose Leena database or Associated vault.
5. Go to the Authentication page:
   • Leena database: in a credential field, type {{ and pick a secret from the vault group, or type a reference such as {{vault.workday-client-secret}}. Fields without a reference keep their typed value.
   • Associated vault: enter the credentials and settings as usual. They are written to the vault, not to Leena AI.
6. Save the connection.

Storage modes

What happens when you save

• Leena database. Leena AI checks every reference: it must be the whole field value, it must point to a secret that exists, and the secret's value must match the field's format. The connection is saved only if all references pass.
• Associated vault. Leena AI writes the whole config to the vault as one secret, then reads it back to confirm it landed. If the vault refuses the write, nothing is saved.
• Switch turned off. The connection is saved with no vault link, whatever else was selected.

Reference rules

• A reference must be the whole field value. Bearer {{vault.token}} is refused: A vault reference must be the whole value, not part of it.
• The authentication type cannot come from the vault.
• A field that other fields depend on cannot come from the vault, because those dependencies are evaluated on the stored value.
• A leena-conn- secret belongs to one connection. It does not appear in the picker and cannot be referenced by another connection.
• Disabled secrets in Azure do not appear in the picker.

Elasticsearch, MongoDB and Env Store connections cannot use a vault; their forms do not show the Credential vault card.

Viewing and Managing Vaults

The Credential vault page lists every vault as a card with its name, status, vault URL and provider. Use the search box to find a vault by name and the provider filter to narrow the list.

Vault detail page

Click a vault card to open its detail page. It shows:

• Vault details: name, provider, vault URL and status (Active or Deactivated).
• Associated keys: each secret's key name, status (Active or Disabled), created on and updated on. Search by key name. Secret values are never shown.
• Connections using this vault: each active connection linked to the vault, with its connector, where its config is stored (Leena database or Associated vault) and its workflow visibility.

Actions

Vaults cannot be deleted. A deactivated vault is hidden from the Associated vault picker, and any connection still linked to it fails with Vault "…" is deactivated until the vault is activated again.

Troubleshooting Workflows

When a vault problem stops a connection, the test result shows Vault error rather than Invalid token, so you can tell a vault issue from a problem with the third-party system.

Troubleshooting a connection that fails with a vault error

1. Open the connection and click Test connection. Read the vault error message; it names the secret and field when one is involved.
2. Go to Integrations → Credential vault and open the vault the connection uses. Check that its status is Active.
3. Click Test connection on the vault. If it fails, the problem is the vault login, not the connection: fix the login details with Edit.
4. If the vault test passes, check Associated keys for the secret named in the error. Make sure it exists and its status is Active.
5. Fix the secret in Azure, or update the connection to reference a different secret, then test the connection again.
6. Check Execution logs for the runs that failed. Values that came from the vault appear as [vault:<field>], never as the secret itself.

Example

A Workday connection stored in Leena database starts failing after the HR team rotates its client secret.

• Test connection on the connection shows: Secret "workday-client-secret" used by auth.clientSecret was not found in the vault.
• The vault test passes, so the vault login is fine.
• Associated keys shows workday-client-secret-v2, but not workday-client-secret. The team created a new secret instead of a new version of the old one.
• Fix: add the new value as a new version of workday-client-secret in Azure, so every connection keeps working with no change. Or edit the connection to reference {{vault.workday-client-secret-v2}}.

Common issues

Understanding Vault Errors

Every vault error has a type that says which part failed. The message never contains a secret value.

A 401 or 403 from Azure is treated as an access error. Leena AI also discards its cached token at that point, so the next attempt signs in again with a fresh token.

Permissions and Visibility

Admins manage vaults. Builders can see vaults and use them in connections. Neither role can see secret values.

For Builders, the admin-only buttons are disabled, with a tooltip such as Only admins can manage vaults.

Best Practices

• Rotate a secret by adding a new version of the same secret in Azure, not a new secret. Every connection then picks up the new value with no change in Leena AI.
• Give Leena AI's app registration only the access it needs: read-only unless you use Associated vault storage.
• Use one vault per environment, such as production and sandbox, and name vaults so the environment is clear.
• Track when the vault's client secret expires in Entra ID. When it expires, every connection using the vault fails.
• Before deactivating a vault, check Connections using this vault and move those connections first.
• Do not edit or delete leena-conn- secrets in Azure. Each holds one connection's whole config.