Account-level BYO credential vault vs per-project Environment secrets

HIIE has two distinct places to store keys and secrets, and it helps to know which one to use. They serve different scopes: your account vs. an individual project.

Account-level BYO credential vault

The account-level credential vault holds your bring-your-own (BYO) provider keys — specifically Composio and OpenRouter — in a per-user, AES-GCM-encrypted store. When you read them back, you see only a masked status (the last few characters); the raw key is never returned to the browser and is read server-side only.

An active OpenRouter BYO key flags your account as "BYO," which makes managed-inference runs unmetered — they show as $0/free and don't draw down managed capacity. These account keys apply across your whole account.

Per-project Environment secrets

The Environment editor lives inside a single project (Software → Environment) and is a CRUD interface for that project's API keys and environment variables. Those secrets are encrypted at rest with a project-scoped key and stored in the project's own file (Misc/env.json). As with the vault, reads return only masked hints (the last few characters) and full values never return to the browser.

How to choose

• Use the account vault for your platform-wide BYO provider keys (Composio, OpenRouter) that affect how HIIE runs inference and integrations for your whole account.
• Use per-project Environment for secrets that belong to one project — the env vars and API keys a specific build or flow needs.

Security note

Both use AES-GCM encryption at rest with server-only keys, and neither ever returns raw values to your browser. This is operator-decryptable encryption, not end-to-end.