Skip to main content
A profile is a named credential namespace inside an organization. Each profile has its own encryption root, so credentials can be partitioned by environment, team, customer, or sensitivity. Every organization is created with a default server_managed profile. A personal account is capped at a single profile, so the create affordance is hidden for it; team organizations are uncapped.

​
Listing profiles

The profiles table shows every profile in the active org:
  • Profile name (a DEFAULT badge marks the seeded default), linking to the profile detail page
  • External ID (if set)
  • Profile ID
  • Storage mode (ZK or Server)
  • Vault status (Unlocked / Locked for zero-knowledge profiles; N/A for server-managed)
  • Created timestamp
Search by name, and filter by storage mode or vault status.

​
Creating a profile

Click New profile (team organizations only). One form covers both storage modes.
1

Name the profile

Kebab-case, unique within the org.
2

(Optional) Set an External ID

A stable identifier your system controls (per-customer or per-tenant). Unique within the org when set.
3

(Optional) Enable zero-knowledge

The default is server-managed (AES-256-GCM, ready immediately). Tick Zero-knowledge encryption (advanced) to make the server store only ciphertext.
4

Set a profile password (zero-knowledge only)

Enter and confirm a profile password (minimum 12 characters). The browser derives a KEK via Argon2id, generates a root key, wraps it, and bootstraps the profile in the same action — the server never sees the password or the root key.

​
Storage modes

There is no server-side reset for zero-knowledge profiles. The dashboard does not generate a recovery key during bootstrap — manage recovery, password changes, and key rotation through the CLI (abadge profile). If you forget the password and have no recovery key, the items in that profile are unrecoverable.

​
Profile detail page

Each profile has a detail page showing its vault status, encryption metadata (KDF, algorithm, key version), a preview of items and agents in the org, a Key management section, and a Danger zone.

​
Key management (zero-knowledge)

The Key management section lists change-vault-password, rotate-item-keys, and recovery-key actions. These operations are not performed in the dashboard — each action points you to the CLI, where the local daemon holds the root key. See Vault security.

​
Delete profile

A profile can be deleted only when it contains no items; otherwise the server returns PROFILE_NOT_EMPTY. Deletion is confirmed by typing the profile name.