Every identity has an encrypted vault for the credentials it needs to work — website
passwords (domain, username, password entries) and key-value secrets (API keys,
tokens, and other env-style values). Everything is encrypted at rest and reachable
over the CLI, the Python SDK, and the TypeScript SDK.

Every example below runs against one identity. Grab it once (or set it as the active
identity in the CLI) and the rest follow. Need one first? See [Identities](/core-concepts/identities/).

CLI:
```bash
ravi identity use <identity-uuid>
```

Python:
```python
from ravi import Ravi

ravi = Ravi(api_key="ravi_id_...")
identity = ravi.identities.get("<identity-uuid>")
```

TypeScript:
```typescript
import { Ravi } from "@ravi-hq/sdk";

const ravi = new Ravi({ apiKey: process.env.RAVI_API_KEY! });
const identity = await ravi.identities.get("<identity-uuid>");
```

## Passwords

### Store a password

Save a login for a site — domain, username, and password, with optional notes.

CLI:
```bash
ravi passwords create acme.com --username agent --generate
```

Python:
```python
entry = identity.vault.passwords.create(
    domain="acme.com",
    username="agent",
    password="s3cr3t-pass",
    notes="Signup for the ops dashboard",
)
```

TypeScript:
```typescript
const entry = await identity.vault.passwords.create({
  domain: "acme.com",
  username: "agent",
  password: "s3cr3t-pass",
});
```

### List passwords

See every stored login for this identity.

CLI:
```bash
ravi passwords list
```

Python:
```python
entries = identity.vault.passwords.list()
```

TypeScript:
```typescript
const entries = await identity.vault.passwords.list();
```

### Get one

Fetch a single entry by id to read its username and password.

CLI:
```bash
ravi passwords get <password-uuid>
```

Python:
```python
entry = identity.vault.passwords.get("<password-uuid>")
```

TypeScript:
```typescript
const entry = await identity.vault.passwords.get("<password-uuid>");
```

### Update a password

Rotate the password (or change any other field) on an existing entry.

CLI:
```bash
ravi passwords update <password-uuid> --password "new-s3cr3t"
```

Python:
```python
entry = identity.vault.passwords.update(
    "<password-uuid>",
    password="new-s3cr3t",
)
```

TypeScript:
```typescript
const entry = await identity.vault.passwords.update("<password-uuid>", {
  password: "new-s3cr3t",
});
```

### Delete a password

Remove a login you no longer need.

CLI:
```bash
ravi passwords delete <password-uuid>
```

Python:
```python
identity.vault.passwords.delete("<password-uuid>")
```

TypeScript:
```typescript
await identity.vault.passwords.delete("<password-uuid>");
```

### Generate a strong password

Get a random, strong password — useful right before creating an entry.

CLI:
```bash
ravi passwords generate --length 24
```

Python:
```python
password = identity.vault.passwords.generate()
```

TypeScript:
```typescript
const password = await identity.vault.passwords.generate();
```

## Secrets

### Store a secret

Save a key-value secret — an API key, token, or any env-style value.

CLI:
```bash
ravi secrets set OPENAI_API_KEY "sk-…"
```

Python:
```python
secret = identity.vault.secrets.create(
    key="OPENAI_API_KEY",
    value="sk-…",
    notes="Prod key for the summarizer",
)
```

TypeScript:
```typescript
const secret = await identity.vault.secrets.create({
  key: "OPENAI_API_KEY",
  value: "sk-…",
});
```

### List secrets

See every secret stored for this identity.

CLI:
```bash
ravi secrets list
```

Python:
```python
secrets = identity.vault.secrets.list()
```

TypeScript:
```typescript
const secrets = await identity.vault.secrets.list();
```

### Get a secret

Fetch a single secret to read its value.

CLI:
```bash
ravi secrets get OPENAI_API_KEY
```

Python:
```python
secret = identity.vault.secrets.get("<secret-uuid>")
```

TypeScript:
```typescript
const secret = await identity.vault.secrets.get("<secret-uuid>");
```

### Update a secret

Rotate the value of an existing secret.

CLI:
```bash
ravi secrets set OPENAI_API_KEY "sk-new…"
```

Python:
```python
secret = identity.vault.secrets.update(
    "<secret-uuid>",
    value="sk-new…",
)
```

TypeScript:
```typescript
const secret = await identity.vault.secrets.update("<secret-uuid>", {
  value: "sk-new…",
});
```

### Delete a secret

Remove a secret you no longer need.

CLI:
```bash
ravi secrets delete <secret-uuid>
```

Python:
```python
identity.vault.secrets.delete("<secret-uuid>")
```

TypeScript:
```typescript
await identity.vault.secrets.delete("<secret-uuid>");
```

---

Looking for exact request and response fields? See the full [API reference](/api/reference/).