Initial Setup
Sign in to Token Vault, deploy and bind your webhook vault, and add your first credential — with no credential ever stored on Token Vault.
This guide walks you through going from zero to a working vault. One prerequisite up front: Token Vault is webhook-sovereign, so you need a webhook server to hold your credentials before anything works. If you don't have one yet, start with the Quickstart — it deploys the reference webhook first, then comes back here.
Sign In
Token Vault uses Google authentication. Go to tokenvault.uk/login and sign in with your Google account. No separate registration is required. Your account is created automatically on first sign-in.
After signing in you will land on the command center dashboard. Since no vault is configured yet, it shows a setup prompt with a link to configure your vault.
Bind Your Webhook Vault
Your credentials are stored on your own infrastructure. Binding is automatic — you never type an HMAC secret by hand:
- Open your deployed webhook's
/bindpage in a browser (e.g.https://your-webhook.example.com/bind). - Click Connect to TokenVault. You're redirected to Token Vault's bind page with a one-time code.
- Review the webhook URL and click Connect. Token Vault exchanges the one-time code at your webhook's
/v1/exchangeendpoint and receives the HMAC secret directly from the webhook.
Add Your First Token
Once your vault is configured, go to the Tokens page and add a credential:
- OAuth flow - click "Connect GitHub", "Connect Google", or another provider button under "Token Vault Managed Logins". Token Vault runs the OAuth exchange and routes the tokens to your webhook with a signed store ticket — it keeps neither.
- Manual entry - click "Add Custom Token" and paste any API key or Personal Access Token (PAT).
OAuth tokens are automatically refreshed when they expire. Manual tokens must be rotated by hand. See Token Management for details on token types and refresh behaviour.
After adding a few tokens your tokens page will look like this:
Next Step
Create an agent → — give an AI agent scoped, time-limited access to the credential you just stored. That's the moment the product does its job.
Also useful from here: Token Management for refresh behaviour, and Access Policies for time windows, rate limits, IP allowlists, and usage caps.
What is Token Vault? Architecture & Core Concepts
Broker scoped, policy-gated access to API keys and OAuth tokens that live on your own webhook — Token Vault routes and audits access but never stores or sees a credential.
Token Management
Add, manage, and refresh API keys, OAuth tokens, TOTP secrets, and raw credentials — all stored on your own webhook, brokered and audited by Token Vault.