Can Cognocient read provider keys from AWS Secrets Manager, Vault or Azure Key Vault?

The strongest position for a provider key is one Cognocient never stores. With a reference, custody and rotation stay with your security team, and cutting our access to the manager cuts the key off without contacting us.

Reference formats

Set it up

1. Integrations → Secret managers: connect the manager.
   • AWS: region plus an access key with secretsmanager:GetSecretValue on only the secrets you reference. Use a read-only, narrowly scoped key.
   • Vault: HTTPS address, KV v2 mount, optional namespace, and a token or an AppRole (role_id and secret_id) whose policy can read only those paths.
   • Azure: tenant ID, vault name and an app registration (client ID and secret) with get permission on secrets.
2. Use Test a reference to confirm it can be read. The value is never shown, only its length.
3. Settings → AI Providers: add the provider and, in the key field, paste the reference. Reference keys are supported for OpenAI, Anthropic, Gemini, Mistral, Groq, Together, Cohere, Jina and Voyage.

Reference keys work on every endpoint that uses that provider's key: chat, embeddings, images, audio, rerank, batches and failover.

Security properties

• The resolved key is never stored, logged or returned by any API.
• Your manager credentials are encrypted at rest and write-only. Give them least privilege.
• Vault addresses must be public HTTPS; private and internal addresses are refused before any request. AWS and Azure hosts are fixed to the official endpoints, and region and vault names are validated so they cannot redirect a request.
• Each connection shows Working or Failing with the last error, so a revoked permission is visible immediately.

Limits

• Business plan; a provider key that is a reference must be the provider's primary key (pooled keys are plain keys).
• Binary AWS secrets are not supported. Vault KV v1 and dynamic secrets are not supported.
• The five-minute cache means a rotated key can take up to five minutes to take effect.