When you log in on different devices or browsers, each session gets its own credential vault. Vault linking lets you unify these sessions so credentials stored in one are accessible from all.
Vault linking is automatic when you:
The new grant inherits your session’s vault automatically. No action required.
Vault linking is manual when you:
In these cases, your sessions have independent vaults. To share credentials between them, you merge the vaults.
You’ll see all active Grants:
| Column | Description |
|---|---|
| Label | Session description (browser, location, or custom name) |
| Type | Login session, API key, or OAuth client |
| Vault | Which vault this session uses |
| Created | When the session was created |
| Last used | Most recent activity |
Grants sharing the same vault show the same vault identifier.
To share your vault with another session:
This creates an escrow—a secure handoff that only the target session can claim.
The target session sees an alert banner the next time it loads:
Vault sharing request [Session label] wants to share their vault with this session. Your credentials will be merged. Accept | Decline
When you accept a vault merge:
Nothing is lost. Your credentials consolidate into the shared vault.
Vault escrows expire after 24 hours. If the target session doesn’t accept in time, you’ll need to initiate the share again.
Now both devices access the same credentials.
Same process. Share from your primary browser to secondary browsers. Each browser session that accepts joins the same vault.
If you logged into the MCP client independently (not via browser authorization):
If you authorized the MCP client from your browser, vault linking happened automatically during authorization.
API keys created from your browser session automatically share your vault. No manual linking needed.
To verify:
If the vaults differ (the API key was created before vault linking existed), use the merge process above.
Vaults exist only while at least one session can access them. This is deliberate.
If your session expires or you log out, and no other session shares the vault:
This is a security feature, not a limitation. It bounds the exposure window—credentials are only accessible while you have an active session.
Don’t treat Toolcog as the master store for your credentials. Your password manager is the source of truth for API keys. OAuth services can be re-authorized in seconds.
If you lose vault access:
This takes minutes. The security tradeoff is worth it.
If you want continuous vault access:
You can only share your own vault. You cannot force another session to share its vault with you.
The target session must explicitly accept. The session holder clicks Accept in their browser or client.
The vault key is wrapped with an encryption key only the target session can derive. Even if someone intercepts the escrow record, they can’t unwrap the key.
Each escrow uses a unique encryption derivation. Compromising one escrow doesn’t help with others.
The 24-hour window passed. Initiate the share again from the source session.
The escrow may have been cancelled by the initiator, or there’s a session mismatch. Check that you’re claiming from the correct session.
Credentials should never be lost during merge. If something seems missing:
