Activity & Audit
Every credential access, agent request, policy decision, and config change — metadata in your dashboard, the full record on your webhook.
The Audit Log page records every significant event in your vault: credential access, agent and MCP proxy requests, token refreshes, policy decisions, and create/update/delete changes to tokens, agents, proxies, and policies.
Where events live
Every event is written through a single choke point and lands in two places:
| Copy | Where | Contains |
|---|---|---|
| Activity feed | Token Vault (drives the dashboard) | PII-stripped metadata only — event type, service, agent/proxy names, policy verdicts. Client IP and user agent are deliberately never stored here. |
| Sovereign copy | Your webhook | The full original event, including client IP and user agent. Yours to retain, query, and alert on however you like. |
The dashboard reads only the metadata feed, so your activity history works even while your webhook is offline — and the complete record stays on your infrastructure.
Event Types
| Event | Description |
|---|---|
| Secret Access | A credential was read directly from the dashboard |
| Agent Access | An agent retrieved a credential via API or MCP |
| Token Refresh | A token was refreshed |
| Policy Denied | An access attempt was blocked by an ABAC policy |
| Config Changes | Tokens, agents, proxies, and policies created, updated, or deleted — including MCP access enabled via OAuth consent |
Sources
Each event records how the access happened:
- Direct -- from the Token Vault dashboard.
- Agent -- an AI agent using its API key or an OAuth session.
- MCP Proxy -- a credential injected into an upstream call via the proxy.
- OAuth Consent -- a change made during the in-browser OAuth authorization step.
Filtering
Use the filter bar to narrow by event type, source, service (e.g.
github), or agent. Other pages deep-link here pre-filtered — e.g. "View
activity" on an agent card shows just that agent's events.
Event Details
Each entry shows what happened, the service badge, a relative timestamp, and — for
policy denials — the specific rule that blocked the request (e.g. time_window,
rate_limit). Request-level forensics (client IP, user agent) live in the full
event on your webhook's copy, not in Token Vault.
Retention
The activity feed is append-only — entries cannot be modified or deleted from the dashboard. Retention of the full sovereign copy is up to your webhook.
Ready to try it?
Sign up free with Google — your credentials stay on your own webhook, and the quickstart gets an agent fetching its first credential in about ten minutes.
Token Management
Add, manage, and refresh API keys, OAuth tokens, TOTP secrets, and raw credentials — all stored on your own webhook, brokered and audited by Token Vault.
How to Give Claude Secure Access to Your API Keys
Three ways to let Claude Code and Claude.ai use your API keys and OAuth tokens without pasting secrets into config files — OAuth 2.1 MCP, credential fetch, and the MCP proxy.