🚀 EDDI 6.5.0

19 LLM providers, knowledge bases that crawl your site and read your files, and conversations that follow compatible agent versionsWhat's new

Managed Cloud Get Started
All integrations
Identity and security${vault:}

Secrets Vault

A built-in, envelope-encrypted secrets vault. Configuration references secrets as ${vault:keyName}, and the value never lands in agent configs, exports or logs.

ConfigurationDocs ↗

What you get

  • ${vault:keyName} references in LLM, HTTP call, MCP and RAG configuration
  • AES-256-GCM envelope encryption with a per-tenant data key
  • Per-agent grants: which agents may use which secret
  • Secrets scrubbed from configuration exports and redacted in logs

How it works in EDDI

  1. Set the vault master key (EDDI_VAULT_MASTER_KEY). The installer generates one for you. Without a key the vault is disabled.
  2. Store a secret with PUT /secretstore/secrets/{tenantId}/{keyName} or through the Manager.
  3. Reference it in configuration as ${vault:keyName}.
  4. EDDI resolves the reference at runtime. The plaintext is not stored in conversation memory.
  5. Narrow allowedAgents to the agents that need the secret. The check runs when an agent is deployed.

Configuration

Taken from the EDDI documentation. Placeholders such as your-agent-id are yours to replace.

Store a secretStore a secret. The response never returns the value.
curl -X PUT http://localhost:7070/secretstore/secrets/default/openai-key \
  -H "Content-Type: application/json" \
  -d '{"value":"sk-your-key","description":"OpenAI key"}'
langchain.json (reference it, never paste it)Reference the secret by name from an LLM task.
{
  "tasks": [{
    "actions": ["send_message"],
    "id": "simpleChat",
    "type": "openai",
    "description": "Simple chat",
    "parameters": {
      "apiKey": "${vault:openai-key}",
      "modelName": "your-model-id",
      "systemMessage": "You are a helpful assistant",
      "addToOutput": "true"
    }
  }]
}
Grant one secret to specific agentsChange who may use a secret without touching its value.
curl -X PUT "$EDDI/secretstore/secrets/default/openai-key/grant" \
  -H 'Content-Type: application/json' \
  -d '{"allowedAgents": ["0123456789abcdef01234567", "89abcdef0123456789abcdef"]}'

Governance

  • Grants are enforced at deploy time by default: an agent that references a secret it is not granted is not deployed.
  • A vault reference that arrives through conversation data, such as user input or a model reply, is refused instead of being resolved.
  • Plaintext is redacted from the request record, the approval preview and the request log line.
  • The vault endpoints sit behind the eddi-admin role when authentication is on.

Good to know

  • EDDI has no native HashiCorp Vault, AWS or Azure client. On Kubernetes, the External Secrets Operator can sync the eddi-secrets Kubernetes Secret (which holds the vault master key) from HashiCorp Vault, AWS Secrets Manager or Azure Key Vault. The individual secrets still live in the EDDI vault.
  • If the master key is lost, the encrypted secrets are unrecoverable. Back it up.
Get startedDocs ↗

Related integrations

Identity and securityKeycloak / OIDCPut OpenID Connect authentication in front of EDDI with Keycloak or another OIDC provider, with roles for admins, editors, users, viewers and approvers.InfrastructureKubernetes and HelmRun EDDI on any conformant Kubernetes cluster with a single-file quickstart, a Helm chart or Kustomize overlays, with MongoDB or PostgreSQL.ChannelsSlackGoverned AI agents in Slack: mentions, direct messages, threads, group discussions streamed into a thread, and Block Kit approval cards with Approve and Reject buttons.

Configuration and behavior on this page follow the EDDI documentation, checked on 2026-10-14. Field names and defaults can change between releases, so confirm them in the docs for your version.