Grok Bot Vault: Logins, Cards, API Keys and 1Password

Vault keeps your logins, cards and contact info so your Bot can sign in to sites and check out for you without seeing the secret values. It lives in Settings > Vault on desktop and on the phone, where you can add, edit or remove anything. It needs Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. 0.75.2 or later.

Scope is the part to think about before you save anything. Vault covers your whole account, so every item is available to every Bot you have, and you can't limit an item to one Bot. With no per-Bot limit, anything one of your Bots shouldn't use is better left out of Vault.

Vault isn't supported on Team Bots. For a Team Bot, keys go under Secrets instead, which is covered further down.

Adding from settings takes three steps. Each item type has its own save button, and cards have a shortcut that saves typing.

1. 1Open Settings > Vault and choose New item.
2. 2Pick Login, Card or Contact info.
3. 3Fill in the details. For a login, enter Website, Username or email and Password, then Save login. For a card, choose Scan with camera or Upload a photo, or type it in, then Save card. For contact info, enter name, address, phone and email, then Save contact info.

Under Hints, tell your Bot when to use an entry, for example "Use for work purchases". The Bot follows the hint when it picks between entries, which matters once you have two cards or two logins for the same site.

You can also save from a chat. When your Bot asks for a login, card or address with a Secure Form, check Securely save to Bot's vault to keep it for next time. Leave it unchecked and the value is kept only for that chat and expires on its own. When you attach a photo of a card, Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. offers Save to Vault so your Bot can pay with it later.

Yes, on desktop, from a CSV export. The supported sources are 1Password, Chrome or Edge, Safari or Apple Passwords, Firefox, Bitwarden and LastPass.

1. 1Export your passwords as a CSV file from the other password manager.
2. 2In Settings > Vault, choose New item, then Import from CSV….
3. 3Select Choose CSV file and pick the export. The file is read on your computer and never uploaded, and it must be under 5 MB.
4. 4Review the list. Items already in your vault are skipped, and rows with an error, such as a missing password or a website that isn't https, aren't imported.
5. 5Choose the import button, which shows how many items are ready.

LastPass exports bring cards along too. The awkward bit is the file you leave behind: the exported CSV holds your passwords unencrypted, so delete it once the import finishes.

The Bot reaches for Vault in four situations. Passwords and card numbers stay hidden from it throughout, while contact info is visible so it can type it in.

• Signing in. It uses a saved login first, then a connected password manager such as 1Password. If neither has the login, it asks you with a Secure Form.
• New accounts. If you let the Bot pick the password when it signs up for a site, Vault generates the password and saves the login. The Bot never sees it.
• Checkout. Saved cards fill in at checkout, and contact info fills shipping and billing details.
• Details you share in chat. When you give a name, address, phone number or email, the Bot saves it as contact info once the task is done and tells you what it saved. Tell it if you don't want something kept.

The Bot can change contact info, and an entry's nickname and hints, when you ask. Passwords, usernames, websites, card numbers and security codes change only in Settings > Vault, and logins and cards are removed only there.

Now the card question, which is the one I'd read twice. The Bot will not necessarily ask before using a saved card. Saving a card lets your Bots fill it in at checkout, and there is no setting that requires your approval each time a saved card is used.

Removing works the same way for logins: after you remove one, Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. can no longer sign in to that site with it. To change a card's number, remove the card and add it again. On the phone, saved cards can't be edited yet.

For anything that isn't a login or a card, use the secure secret card when a Bot asks for one. The field is masked. Choose Save securely, and the card then says Saved and Saved securely and kept private. The value is never written into the chat.

On a Team Bot you own or manage, you can also add a secret from the Bot's details. Open Secrets, choose Add secret, enter an environment variable name, a short description and the value, then Save secret. The description is visible to the Bot and the value is not. Those secrets are used in every teammate's chat with that Bot, so only add keys you're happy for everyone who can chat with it to use.

• Don't paste secrets into chat, Shell or ordinary files.
• Don't type them into a demonstration when you use Teach a task.
• A credential your company's setup scripts need, such as a license key for a tool on every team computer, belongs with a team admin as a Team Secret on the Enterprise dashboard. Those never reach your Bots directly.

Saved values are write-only, which is expected behavior. A blank field later is not proof the secret was deleted, and the table shows what each surface displays instead of the value.

To change a Team Bot secret, choose Replace, paste the new value and choose Replace value. You can't read the old value back. No secrets yet means that Bot has no saved names, nothing more. If a card says Could not fill into the page, the page may have moved; the value still wasn't shown to the Bot, and you submit a new card if it asks again.

Then the Update question. Recover, Reset and computer updates remove installed apps and packages, so a secret you typed into a file, a shell profile or an installed tool on the computer can disappear with them. Secrets saved with the secure card, under Secrets or in Vault are separate from that. Shell not printing a secret does not mean it was wiped, and on a Team Bot, if the name is still listed under Secrets, the value is still stored. What each recovery option keeps is on the computer and apps page.

If a Team Bot's secret name is gone and you didn't choose Remove, fully quit and reopen Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. (on Mac, Quit from the menu bar), check the same Bot on another device signed into the same account, and choose Try Again if the list shows an error. Only add it again if it's missing everywhere, and don't keep a copy in a file on the computer.

1Password lets your Bots sign in to websites on their computer with logins from your 1Password account. You approve each login in 1Password, 1Password fills it in, and your Bots never see the values. The new integration is rolling out gradually, works with personal and Family accounts, and needs 1Password 8.12.42 or later.

1. 1Select Connect apps and open 1Password, under Password Managers.
2. 2On your computer, choose Connect 1Password.
3. 3Sign in to 1Password in the browser that opens and approve Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition.. Grok Bot updates when you're done.

On the phone, open 1Password from the Password Managers shelf in Connect apps, or search for it, then approve in 1Password. If the phone says 1Password can only be set up on a Mac, the new integration hasn't reached your account yet, so set it up from your computer.

When a login isn't in Vault, the Bot sends a card in the chat naming the website. Choose Review in 1Password, pick the exact logins to share, approve, and 1Password fills the login in the Bot's browser. A shared login stays available in later chats until 1Password stops allowing it. 1Password does not fill payment cards, and the Bot still needs you for a passkey, single sign-on or a captcha it can't get past.

Two limits explain most "why isn't my login offered" moments. 1Password only offers logins from your own Personal vault (Private on Family accounts), never from shared vaults, so move or duplicate the login there first. And if you used the old integration, it relied on a service account and the new one doesn't, so you connect again and move the logins from the old shared vault into Personal or Private. The 1Password page in Connect apps tells you how many need moving. To stop, open 1Password in Connect apps and choose Disconnect. Other connectors live on the computer and apps page.