Check a key before you store it, then keep it healthy
Is this key any good, and is my vault in order?
Test a credential before anything is saved, store it as the default for its type, then let QuoxVault point out what needs attention.
What you get: no broken keys in your vault, and a short list of what to fix. You need: a signed-in profile. About 5 minutes.
Do it yourself
Section titled “Do it yourself”The run below uses a made-up PyPI upload token. QuoxVault checks PyPI tokens for format only, because PyPI offers no read-only call to test one against; types with a live test, such as npm, are checked against the service itself. quox vault types says which is which.
1. Put the fields in a file only you can read
Section titled “1. Put the fields in a file only you can read”Write the credential’s fields as JSON to a file with 0600 permissions, so the value never sits in your shell history. The PyPI type has one field, api_token. --credentials-stdin reads the same JSON from standard input instead, and a value can be env:VAR_NAME to read it from an environment variable.
2. Test it without saving
Section titled “2. Test it without saving”quox vault test-new --type pypi --credentials-file pypi-token.json- Testing credentials (nothing will be saved)...✔ Connection test passed. Nothing was saved.quox vault listNo credentials found.The vault is still empty: a test stores nothing.
3. Store it
Section titled “3. Store it”quox vault create --type pypi --label "PyPI release token" --credentials-file pypi-token.json --no-input- Creating credential...✔ Credential created.id 01M6MDXW4GVNBMBMTDTHMEE65Yintegration_type pypilabel PyPI release tokenkey_preview ****is_default 0test_status untesteduse_count 0visibility orglease_required 0--no-input makes the command fail with a clear message rather than prompt, which suits scripts. The secret itself is never shown again; the preview is masked. A new credential is not the default for its type until you make it one, and the command says so.
4. Make it the one agents use
Section titled “4. Make it the one agents use”quox vault set-default 01M6MDXW4GVNBMBMTDTHMEE65YⓆ QUOX │ vault credential default set │ 01M6MDXW4GVNBMBMTDTHMEE65Y · pypi ✔The default is the active credential for its type, so with several PyPI keys stored, this is the one in use.
5. Ask the vault what needs attention
Section titled “5. Ask the vault what needs attention”quox vault scan- Running health scan...Found 1 issue(s): Severity Type Label Issue Messagewarning pypi PyPI release token stale Never usedquox vault expiringNo credentials expiring within 7 days.quox vault stats╔═══════════════════════════╗║ QuoxVault Health ║╟─────────────╤─────────────╢║ Credentials │ 1 ║╟─────────────┼─────────────╢║ ● Healthy │ 0 ║╟─────────────┼─────────────╢║ ● Failed │ 0 ║╟─────────────┼─────────────╢║ ○ Untested │ 1 ║╟─────────────┼─────────────╢║ ◐ Stale │ 1 ║╟─────────────┼─────────────╢║ Total Uses │ 0 ║╟─────────────┼─────────────╢║ Encryption │ AES-256-GCM ║╚═════════════╧═════════════╝ Type Count Healthy Failedpypi 1 0 0scan lists each problem with how serious it is: here a key nobody has used yet. expiring warns about keys close to their expiry date. stats counts your credentials by health and by type, and shows how they are encrypted.
What just happened
Section titled “What just happened”The test saved nothing. The key was stored encrypted and is only ever shown masked, and setting the default changed which PyPI credential is active. Storing, setting the default and deleting each wrote a line to the vault’s audit trail.
Check it yourself
Section titled “Check it yourself”quox vault activityTime Action Actor Status Target2026-11-04 23:23:17 integration.delete user success 01M6MDXW4GVNBMBMTDTHMEE65Y2026-11-04 23:22:42 integration.set_default user success 01M6MDXW4GVNBMBMTDTHMEE65Y2026-11-04 23:22:25 integration.create user success 01M6MDXW4GVNBMBMTDTHMEE65Yquox vault list shows each credential with its status, whether it is the default, and how often it has been used.
quox vault delete 01M6MDXW4GVNBMBMTDTHMEE65Y --forceⓆ QUOX │ vault credential deleted │ 01M6MDXW4GVNBMBMTDTHMEE65Y ✔quox vault listNo credentials found.Without --force, delete asks you to confirm first.
- Find out what a credential needs before you add one
- Back to credentials