# Secrets and the vault

Protect your project credentials with a PIN, and manage when secrets lock.

## Set up the vault

In the desktop app, open **Settings → Security → Set up PIN**. Enter and confirm a four-digit PIN, then select **Save PIN**. The same PIN is used for every project in your local workspace.

Save the recovery code shown after setup somewhere safe outside Orbit. Changing the PIN replaces that recovery code and locks secrets again.

## Add a secret

1. Open a project's **Secrets** section and enter your PIN.
2. Select **Add secret**.
3. Enter its name and value.
4. Choose an environment and optionally a service, management URL, and description.
5. Save the secret.

An environment separates values such as development and production. A service groups related credentials, such as a payment provider or database. Names must be unique within the same environment.

## Reveal, copy, and edit

Select a secret to inspect its details. Use its value visibility control to reveal it when needed, and **Copy value** to copy the credential. Use **Edit secret** to update it. Search and the Environment and Service filters help find a particular entry.

The management URL opens the service page where you administer that credential. You can edit the description beside a selected secret; it autosaves, so resolve any save error before switching away. Collapse service groups to shorten a long list.

Select several secrets to change their environment or service together. Bulk actions apply to the whole selection, so review the selected count and entries even after changing filters. Deleting a secret permanently removes that saved value.

## Lock and clipboard settings

Select **Lock** to lock the vault immediately. In **Settings → Security**, choose **Lock after unlocking** and **Clear copied secrets after**, then save. Saving a lock-duration change locks secrets immediately.

Clipboard clearing removes the copied secret after the configured period. If you copy something else in the meantime, Orbit leaves that newer clipboard content alone. Locking the vault and clearing the clipboard use separate timers.

## Backup and access boundaries

Workspace ZIP exports exclude vault secrets. Use the separate [.env export](/guide/secrets/env-files/) when you need to transfer selected values; that file contains plaintext.

MCP clients can add encrypted secrets and read secret metadata, but cannot reveal their values or unlock the vault. If you forget the PIN, follow [PIN recovery](/guide/secrets/recovery/).