How registry matching works
When you store a secret withaivault secrets create --name <NAME>, the system checks every registry provider’s vaultSecrets map. If <NAME> matches a key, the secret is:
- Pinned to that provider (immutable — cannot be re-pinned)
- Used to auto-provision a credential with the correct auth strategy
- Used to enable all capabilities defined in the registry entry
OPENAI_API_KEY matches the openai provider’s vaultSecrets:
OPENAI_API_KEY, pin it to openai and map it to the {{secret}} placeholder in auth templates.”
Security properties of the registry
- Compiled into binary — provider definitions cannot be tampered with at runtime
- Immutable pinning — once a secret is pinned to a provider, it cannot be moved
- Host allow-lists — each capability specifies exactly which hosts it can reach
- Single host per capability — prevents cross-host confusion
Pages in this section
- Custom providers — adding providers not in the built-in registry
- Registry schema — the JSON schema for registry provider definitions