The same Skill runs in several Spaces, but each Space needs a different external account. Should the credential live in user defaults, a Space override, or an API key override? If the same name exists at all three levels, which value does the runtime receive?
For the same name in Busabase Vault, the effective runtime value is resolved in this order: API-key override > current Space override > personal default. The Space layer lets one Skill use a different external account in each workspace; the API-key layer can further specialize a particular integration credential. The key override applies when the request is authenticated with that API key, so first confirm which key and Space the agent is actually using.
Only enable Runtime for a secret the agent or server needs. Reveal controls whether a member may explicitly view a value; it does not stop an authorized runtime from receiving it. To avoid sending a secret into browser code, resolve it in a trusted server/runtime and keep the key out of client bundles and logs. A quick check is to store harmless test values at the three scopes, run the same Skill with each intended Space/key, and verify which non-secret marker is selected before configuring real credentials.
Sign in to join the discussion. Reading is always open; you only need an account to post.
Sign in