Credentials Vault
What it does
The Credentials Vault is a secure place to store the passwords, API keys, database credentials, certificates, and other secrets your team relies on. Every sensitive value is encrypted before it's stored, so only people you've granted access can see them.
Who can use it
- Anyone in your organization with read access to the Credentials module. Storing a new credential needs create rights; editing needs write rights. Roles are managed by your Super Admin.
- The Credentials Vault must be enabled for your organization, otherwise you'll see a "Feature disabled" message with a request-access option.
- Your organization may have a monthly limit on how many credentials you can add. When the limit is reached, the New credential button is disabled.
Where to find it
From the sidebar, open Profile & Company and click Credentials Vault.
What you'll see
- A left sidebar with a search box, credential Types (Password, API Key, Database, etc.), and Folders.
- The main area shows your credentials. Toggle between List and Cards view at the top.
- A vault status badge confirms encryption is on (VAULT · AES-256 · UNLOCKED).
- Top-right action buttons: Refresh, New credential, and Folders.
- Under New credential: Import, and for owners and admins, Export.
Store a new credential
- Click New credential in the top-right. The Add New Credential dialog opens.
- Fill in the Basic Information:
- Name (required) — a short label, like "AWS console login" or "Stripe API key".
- Description — optional notes for your future self or your team.
- Folder — optional, to group with related credentials.
- Shared Access — pick teammates who should be able to see this credential. Owners always have access.
- Pick a Type (required). Each type asks for different fields:
- Password — Website URL, Username, Password.
- Database Credentials — Hostname, Port, Database Name, Username, Password.
- Certificate — Certificate content.
- SSH Key — SSH key content.
- Client ID / Secret — Client ID and Client Secret.
- API Key — the key value.
- Token — the token value.
- Other — a free-form value field for anything that doesn't fit the categories above.
- Required fields are marked with a red asterisk. For passwords, a strength meter shows how strong your password is as you type.
- Click Create Credential. Nautis encrypts and stores the values, then closes the dialog.
Import credentials
- Click Import under New credential. You need create rights for the Credentials module.
- Pick a file. Nautis recognises:
- The Nautis template. Click Download template for a CSV with one sample row per credential type.
- A Nautis encrypted export (
.nautisvault). You'll be asked for the passphrase it was exported with. - A CSV export from 1Password, Bitwarden, LastPass, Chrome / Edge / Brave or Firefox.
- Check the preview. Each row shows its type, folder and status. Secrets stay masked. Rows marked Missing … (for example a password without a username) are skipped. Cards and identities from password managers aren't supported and are counted separately.
- Leave Skip duplicates on to ignore entries whose name and type already exist in the vault.
- Click Import N credentials. Folders named in the file are created if they don't exist yet.
Your file is read in your browser, and nothing from it is sent to AI. Imported credentials belong to you and aren't shared. Share them afterwards from each credential. Imports count towards your workspace's monthly credential limit.
Export credentials
- Click Export under New credential. Only workspace owners and admins see this button.
- Choose a format:
- Encrypted file (recommended). Pick a passphrase of at least 12 characters and type it twice. The
.nautisvaultfile can only be opened by importing it into Nautis with that passphrase. Nautis doesn't keep the passphrase, so if you lose it, the file can't be opened. - Unencrypted CSV, for moving to another password manager. Every secret is in plain text, so you'll be asked to confirm you understand. Delete the file once you've imported it elsewhere.
- Encrypted file (recommended). Pick a passphrase of at least 12 characters and type it twice. The
- Confirm it's you: enter your account password, plus your authenticator code if two-factor authentication is on.
- Click Export. The file downloads straight away.
The export contains the credentials you can see in the vault. The workspace owner gets an email about every export, and each one is recorded in the audit log. If you signed up with Google or another social login and don't use two-factor authentication, turn it on in Account Settings → Security first. Nautis needs a way to confirm it's really you.
View a credential
- Click any credential in the list. Its detail panel opens.
- Secret fields are hidden by default — click the eye icon next to a value to reveal it. Click the copy icon to copy it to your clipboard.
- Reveals auto-hide again after a short period so a secret isn't left visible on your screen.
Edit a credential
- Open the credential's detail panel.
- Click the edit (pencil) action. The form opens pre-filled with your saved values.
- Update what you need, then save. You'll see a confirmation toast.
Organize with folders
- Click Folders in the top bar (or the + button next to the Folders heading in the left sidebar).
- Create, rename, recolour, or delete folders.
- Assign a credential to a folder by editing it and picking from the Folder dropdown.
- Use the folder list in the sidebar to filter to All folders, Unfoldered, or a specific folder.
Delete a credential
- Open the credential's detail panel.
- Click the delete action. Nautis shows a Delete Credential confirmation dialog because the action can't be undone.
- Confirm. The credential and its encrypted values are removed.
Tips & limits
- Every credential value is encrypted at rest using AES-256 — even Nautis staff can't read it without your access. The plain text is only decrypted when you reveal it in the UI.
- Use folders to separate environments (production, staging) or systems (AWS, Stripe, internal databases). It makes audits and onboarding easier.
- The password strength meter is for your own reference — Nautis won't reject a weak password, but using a strong one is always a good idea.
- Search in the sidebar matches credential names and descriptions only, not secret values (those stay encrypted).
Frequently asked questions
Who can see my credentials?
Only you (the owner) and the teammates you've explicitly added under Shared Access. Members of your org without that share won't see the credential at all.
Can Nautis support staff read my passwords?
No. Secret values are encrypted before they leave your browser-side request. They're decrypted only when an authorised user opens them in the UI.
What happens to shared credentials when a teammate leaves?
When their account is removed from your organization, they lose access automatically. You may want to rotate the underlying secret as a precaution.
Can I export my credentials?
Yes, if you're a workspace owner or admin. See Export credentials above. The encrypted file is the safe option. Use the unencrypted CSV only to move to another password manager.
Can I move my passwords from 1Password, Bitwarden, LastPass or my browser?
Yes. Export a CSV from that tool and use Import. Nautis maps the columns for you.
What's the difference between Client ID / Secret, API Key, and Token?
They're all secrets, but each has its own form so the right labels show up. Pick the one that matches what your service calls it; if in doubt, use Other.
Can I recover a deleted credential?
No. Delete is permanent — that's why Nautis asks you to confirm.
Still need help?
Our team answers every message. Already a customer? Open a support ticket from inside Nautis.

