Credential vault
Keep customers' passwords and two-factor seeds encrypted and masked, reveal one with a reason and a recent two-factor confirmation, see who revealed what, and share selected passwords in the customer portal.
Updated
The credential vault keeps passwords for each customer and your own (internal) ones. It's part of Revo itself, so it works whether or not RevoDocs is on, and other modules use it too.
Add a credential
Open Credentials and choose Add credential: a name, the username, the password, the address you sign in at, an optional two-factor seed and notes. The password and seed are encrypted before they're stored. Notes aren't, so keep secrets out of them.
Lists, search and records never show a password. To change one, enter the new one: you don't need to reveal the old one first.
Reveal a password
Reveal asks why you need it. Your reason, your name and the time go in the audit log. You also need a two-factor confirmation from the last 15 minutes: if you signed in with your authenticator code more than 15 minutes ago, Revo asks for a fresh code. The password then shows for a minute, with a button to copy it.
Owners, admins and technicians can reveal passwords; analysts see the vault without them. Accounts without two-factor authentication can't reveal anything: turn it on in Settings → Account security.
Two-factor codes
Save a credential's two-factor seed (the text under the QR code, or the otpauth:// address) and revealing the credential shows
the current six-digit code with the seconds left, so your team can sign in to a shared admin account without one
phone. The seed itself is never shown again.
History
Owners and admins see each credential's history in its details: when it was added and changed (which fields, never the values), every reveal with its reason, and any module that used it.
The customer portal
Share in the customer portal shows a customer's credential to that customer's portal users under Passwords. They reveal it the same way: a reason and a recent two-factor confirmation.
API tokens
Tokens can list credentials but can't reveal them unless their scopes name core.vault.reveal. A token made with "everything my role allows" doesn't get it. Each reveal by a token is audited under the token's name.