Troubleshooting & FAQ

Signing in

Too many sign-in attempts

After 10 wrong passwords or 5 wrong authenticator codes in 15 minutes, sign-in is blocked for a while. Wait and try again, or reset your password if you have forgotten it. See attempt limits.

An email code doesn't work

Codes expire after 10 minutes and are destroyed after 5 wrong tries. Request a new one; you can request one every 60 seconds.

Google sign-in doesn't reach my account

Google is never linked to an existing account automatically, even when the email address matches. Sign in the way you originally did, then link Google in Settings → OAuth Connections.

I lost my authenticator

If you registered a passkey, it can stand in as your second factor. Otherwise, email support@apivault.tech.

I was signed out everywhere

Resetting your password ends your browser sessions and revokes your CLI and MCP tokens. Sign in again, run apivault login, and reconnect your agents. If you didn't reset it yourself, check your sessions and devices and the project's audit log.

Keys and projects

A key I expected isn't there

Check that you're in the right project, then the environment. Environment names must match exactly, so Prod and Production are different. In the CLI, apivault projects current shows which project is in use. The audit log shows if someone deleted the key.

I can see keys but can't change them

Viewers have read-only access. Ask a project owner or admin to change your role. See projects & RBAC.

It says the key already exists

A name can be used once per environment in a project. Update the existing key, or use a different name or environment.

I forgot my custom vault key

It cannot be recovered, by you or by ApiVault, and neither can the values encrypted with it. A project owner can reset the project's encryption from the Danger Zone in Project Settings. That permanently deletes every key in the project and returns it to default encryption, keeping its members. You then add the keys again.

My vault key keeps being rejected

After 10 wrong vault keys in 15 minutes, requests are refused for a while, even with the right one. Wait for the delay shown, then try again carefully.

MCP and AI agents

My agent is using the wrong project

A connection is tied to the project you chose when you approved it. Revoke it in Settings → MCP Connections, reconnect, and choose the right project.

A tool call is refused

INSUFFICIENT_SCOPE means the connection wasn't approved for that action, so reconnect and grant the scope. If it has the scope but writes still fail, your role in the project may be Viewer, which limits agents too. See MCP error codes.

My agent asks to sign in again

Access tokens last an hour and clients refresh them on their own, but a refresh token lasts 30 days. After that, or after the connection is revoked, approve it again.

The consent screen says Unverified

That's expected: MCP clients register themselves, so their name and icon can't be confirmed. Check that the redirect origin shown matches the tool you started from before you approve. See MCP security.

Integrations

A key is reported as a conflict

The platform already has a variable with that name that ApiVault didn't create, and ApiVault won't overwrite it. Delete or rename your copy on the platform, then click Sync now.

A key isn't being sent

Check that its environment is mapped to a target, since unmapped environments aren't sent, and that its name is valid for the platform. Keys that were skipped are listed in the sync's issues. The rules are on each page: Vercel, Supabase, Cloudflare Workers and GitHub Actions.

A key is reported as over limit

The platform refused it for reaching its own limit. See integration limits.

Auto-sync is off and can't be turned on

In custom encryption mode the server can't decrypt your keys on its own, so it can't sync in the background. Click Sync now and enter the vault key each time.

A new value isn't live on Vercel

Vercel reads variables at build time, so a change only reaches a deployment once it is rebuilt. Turn on Redeploy production on change to do this automatically.

My Vercel project isn't listed

Vercel only shows ApiVault the projects you allowed. Click Manage access on Vercel under the project list, add it, and search again.

Service tokens and CI

An expired, revoked or IP-blocked token says so in its error. A plain 401 Unauthorized means the value never matched a token, usually because of a truncated copy or a secret set on the wrong repository. Run apivault whoami in the pipeline to see what it picked up. Some CLI commands are not available to service tokens at all; see which CLI commands work.

FAQ

Can ApiVault read my secrets?

In default mode, values are encrypted with keys the server manages, so the server can decrypt them when an authorized request asks. In custom mode, ApiVault keeps no recoverable copy of your vault key and can't decrypt without it. See encryption architecture.

Can I self-host ApiVault?

No. ApiVault is only available as a hosted service.

Can a deleted key be restored?

No, deleting a key can't be undone. The audit log keeps a record that it happened, but not the value.

Should I use the CLI or MCP?

The CLI is for you, your scripts and your pipelines. MCP is for AI agents working in your editor. See when to use which.

What happens when someone leaves a project?

They lose access to its keys straight away, but service tokens they created keep working so deploys don't break. Those tokens are flagged on the Service Tokens page; review them and revoke any you no longer want.

I think a secret leaked. What should I do?

Rotate it with the provider that issued it first, since that is what actually stops it working, then update the value in ApiVault. Check the audit log for who revealed it, and revoke any tokens or connections you don't recognize.

Where do I get more help?

Check the system status, or email support@apivault.tech. To report a security issue, follow reporting a vulnerability.