# Keep logins and secrets in the Vault

> Keep logins, keys and cards, choose who can use them, and lock private items with your passkey.

The Vault is one place for the logins of the business, its keys, its secrets, its notes and its cards. Troopy seals
every value. Teammates sign in with logins by reference, and never see a password. This page tells how to add items,
choose who uses them, and keep private items that only you can read.

## Before you begin

- The Vault is a product. A person sees it only when it has the product.
- To see or copy a hidden value, you need a passkey. See [Manage your account](/docs/account).

## The kinds of items

| Kind            | What it holds                                                                                                |
| --------------- | ------------------------------------------------------------------------------------------------------------ |
| **Login**       | A **Username**, a **Password**, the sites where it **Signs in on**, and a one-time code if the site has one. |
| **API key**     | A key of a service, with its name.                                                                           |
| **Secret**      | Any value to keep hidden.                                                                                    |
| **Secure note** | Words to keep hidden.                                                                                        |
| **Card**        | A payment card that teammates may pay with, within limits.                                                   |

Hidden values keep their **Earlier values**, so that you can go back to one.

## Add an item

1. Open **Vault**, then select **New item**.
2. Pick the kind, and fill the fields. **Generate a strong password** makes a password for a new login.
3. For a login with a one-time code, paste **The setup key, or the otpauth:// address**.
4. Pick the **Collection**.
5. Save.

Troopy seals each value as it arrives. Over the API, values go in and never come out.

## Collections

A collection groups items, and says who can reach them. Select **New collection** to make one.

| Level               | What a person can do                         |
| ------------------- | -------------------------------------------- |
| **Can see names**   | See the names of the items.                  |
| **Can use and add** | Use the items, and add new ones.             |
| **Can manage**      | Change and delete the items, and the access. |

Give a level to people one by one with **Add a person**, or to **Everyone in the workspace**. Owners and admins can
always manage every collection.

**Teammates that may sign in with its logins** names the teammates that use the logins of the collection. Otherwise
each teammate keeps its own logins in a collection named after it.

## How teammates use a login

- A teammate never sees a password. Troopy types it in for the teammate, only on the own site of the login.
- **Only at these sites** limits a login to some sites. Teammates only ever use this login on these sites.
- When a teammate needs a login that it lacks, it asks on its task. Add the login, and the teammate continues.
- A teammate can make a new account on a site after a person says yes. Troopy saves the new password in the Vault
  before the teammate types it. Such a login shows **Not confirmed** until it works.
- Troopy writes an event before it releases a value. **Activity** lists what happened with each item.

## Cards that teammates pay with

Turn on **Teammates may pay with this card** on a card, and set its limits:

| Limit                   | What it does                        |
| ----------------------- | ----------------------------------- |
| **A purchase up to**    | The largest amount of one purchase. |
| **A month up to**       | The largest amount in one month.    |
| **Only at these sites** | The shops where teammates may pay.  |

An owner or admin says yes for each payment, for that amount at that shop. Then the teammate fills the card, and the
payment goes through one time.

## Import from another password manager

1. Select **Import**, and **Pick the export file**: 1Password, Bitwarden, LastPass or Chrome.
2. Pick the collection to put the items **Into the collection**.
3. Confirm. The file is read on your computer. Only its items go to Troopy, sealed as they arrive.

> [!WARNING]
> After the import, delete the export file. It holds every password in the clear.

## See or copy a hidden value

1. Select **Unlock with your passkey**. A passkey unlocks the vault for 10 minutes.
2. Select **Show the password** or **Copy the password**.

Each reveal is an event in **Activity**.

## Private items: only you

**Only you** holds your own logins, end to end. Your browser encrypts each private item under your passkeys. Troopy keeps
only the encrypted text, and cannot read it.

1. Select **Turn on private items**, and confirm with your passkey.
2. Save the **Recovery code** of the recovery kit. It opens your items if you lose your passkeys.
3. Select **New private item** to add one.

To let another of your passkeys open them, select **Let this passkey open them**. With no passkey that opens them, select
**Use recovery kit**.

> [!WARNING]
> If you lose your passkeys and your recovery code, nobody can open your private items. Troopy cannot open them either.

## Related

- [Manage your account](/docs/account)
- [Stay in control of your troop](/docs/control)
- [Watch the computer of your troop](/docs/computer)
- [Invite people and choose their roles](/docs/people)