Meta tags:
description=Encrypt, store, and control access to sensitive data.;
keywords=WorkOS Vault, enterprise key management, EKM, encrypted key-value storage, BYOK bring your own key, envelope encryption API;

Headings (most frequently used words):

key, secrets, vault, introduction, on, this, page, features, common, use, cases, multi, region, support, encrypted, value, storage, enterprise, management, ekm, bring, your, own, byok, organizational, user, application,

Text of the page (most frequently used words):
key (29), and (19), vault (17), your (14), data (13), keys (12), encryption (11), workos (10), the (10), with (9), api (8), region (8), application (8), #secrets (8), byok (8), this (7), management (7), for (7), start (6), access (6), context (6), support (5), encrypted (5), quick (5), multi (5), while (5), cloud (5), can (5), user (5), control (5), reference (5), security (4), features (4), you (4), replicated (4), risk (4), store (4), sensitive (4), own (4), sdks (4), migrate (4), integrations (4), events (4), overview (4), use (3), automatically (3), over (3), any (3), workloads (3), credentials (3), encrypt (3), such (3), provide (3), information (3), protected (3), including (3), organization (3), ensures (3), enterprise (3), ekm (3), inc (2), customers (2), single (2), sign (2), step (2), using (2), manage (2), objects (2), stored (2), object (2), february (2), 2026 (2), that (2), existing (2), are (2), secondary (2), operations (2), without (2), many (2), services (2), certificates (2), service (2), unique (2), lifecycle (2), linked (2), each (2), secret (2), full (2), cryptographic (2), from (2), other (2), organizational (2), common (2), cases (2), integrating (2), seamlessly (2), secure (2), compliance (2), kms (2), bring (2), customer (2), applications (2), provided (2), isolated (2), value (2), storage (2), page (2), getting (2), started (2), search (2), docs (2), privacy, legal, careers, about, company, pricing, podcast, blog, resources, status, changelog, documentation, developers, fine, grained, authorization, admin, portal, directory, sync, authkit, next, guide, how, prior, want, take, advantage, write, new, version, keyed, written, after, migration, all, were, migrated, configuration, changes, required, hosted, failover, every, managed, primary, becomes, unavailable, decryption, fail, action, part, adds, resilience, backed, keeping, fully, transparent, short, lived, dynamic, static, represent, huge, get, spread, out, across, making, rotation, difficult, increasing, leak, database, pki, centralized, them, runtime, personally, identifiable, pii, health, phi, highly, have, strict, regulatory, requirements, strong, controls, minimization, mishandling, very, high, both, financially, reputationally, lets, needing, complex, hierarchies, b2b, often, specific, shared, oauth, even, generated, protects, easily, links, belongs, order, separation, organizations, within, either, environment, directly, environments, gives, tooling, siems, stay, custody, enabling, perfect, driven, integration, available, popular, amazon, web, google, compute, azure, hashicorp, centralize, used, tenant, architectures, streamlines, policies, auditability, segmentation, reducing, enforcing, boundaries, make, sense, business, uses, cryptographically, based, envelope, enhances, encrypting, dek, which, then, kek, approach, remains, allowing, developer, friendly, optionally, tokens, passwords, files, content, ideal, scaling, minimizes, exposure, simplifies, introduction, copy, dashboard, feedback, press, homepage,

Text of the page (random words):
vault workos docs workos docs homepage vault vault press k to search k search api reference feedback dashboard sign in getting started overview overview quick start quick start key context key context byok byok api reference api reference events events integrations integrations migrate to workos migrate to workos sdks sdks getting started overview overview quick start quick start key context key context byok byok api reference api reference events events integrations integrations migrate to workos migrate to workos sdks sdks vault encrypt store and control access to sensitive data copy page introduction on this page key features encrypted key value storage enterprise key management ekm bring your own key byok common use cases organizational secrets user secrets application secrets multi region key support workos vault is a developer friendly ekm to encrypt and optionally store data including tokens passwords certificates files and any other customer content ideal for scaling encryption in cloud applications it minimizes key exposure and simplifies compliance key features encrypted key value storage each secret stored with vault uses a unique encryption key and is cryptographically isolated based on user provided context envelope encryption enhances security by encrypting data with a data encryption key dek which is then encrypted with a key encryption key kek this approach ensures sensitive data remains protected while allowing secure key management and access control enterprise key management ekm the enterprise key management features of vault centralize control over encryption keys used for customer data in multi tenant architectures it streamlines key lifecycle management access policies and auditability while integrating seamlessly with your existing applications key segmentation by organization user or any provided context ensures cryptographic keys are isolated reducing risk and enforcing access control at boundaries that make sense for your business bring your own key byok with vault you can provide keys either from your own environment or directly linked to your customers cloud environments byok gives you full control over encryption keys while integrating seamlessly with your own security tooling such as cloud siems it ensures your keys stay protected in your custody while enabling secure access for encryption operations perfect for compliance driven workloads byok integration is available for many popular key management services including amazon web service kms google cloud compute kms azure key vault and hashicorp vault common use cases organizational secrets sensitive data in a b2b application is often linked to specific organization this can be shared secrets api keys oauth credentials or even data generated by your application vault protects this information and easily links each secret with the organization it belongs to in order to provide full cryptographic separation from other organizations within your application user secrets user data such as personally identifiable information pii or protected health information phi is highly sensitive and can have strict regulatory requirements including strong encryption access controls and data minimization the risk for mishandling this data is very high both financially and reputationally vault lets you store this data using unique encryption keys without needing to manage the complex lifecycle of key hierarchies application secrets with short lived dynamic workloads in the cloud static credentials represent a huge security risk secrets can get spread out across many services making rotation difficult and increasing the risk of a leak vault can encrypt and store application data such as api keys database credentials and pki certificates in a centralized service and provide them to your application at runtime multi region key support as of february 2026 vault hosted keys support multi region failover every workos managed key is automatically replicated to a secondary region so if the primary region becomes unavailable encryption and decryption operations fail over to the secondary region without any action on your part this adds resilience to vault backed workloads while keeping key management fully transparent to your application all existing single region keys were migrated to replicated keys automatically no configuration changes are required if you stored an encrypted object in vault prior to february 2026 and want it to take advantage of multi region support write a new version of the object so that it is re keyed with a replicated key objects written after the migration use replicated keys automatically quick start a step by step guide on how to start using vault to manage encrypted objects up next workos inc features authkit single sign on directory sync admin portal fine grained authorization developers documentation changelog api status resources blog podcast pricing security support company about customers careers legal privacy workos inc