Core Concepts
Link password-manager items
Point clients and projects at the right credential in 1Password, Bitwarden or another password manager
Keep track of which credential goes with which client or project — "Client AWS root", "Staging database", "Deploy SSH key" — without putting the secret in Consultainer. Each credential link is a pointer to an item in your password manager. Clicking it opens the item there.
What Consultainer stores: the link to the item, a label, an optional note, which password manager it's from (worked out from the link) and an optional kind (login, SSH key, API key, document, other).
What it never stores, fetches or shows: the password, key or token itself. Consultainer doesn't connect to your password manager and never opens the link on its own.
Access is up to your vault. When someone clicks Open in 1Password, 1Password decides whether they can see the item. If they have access, it opens; if they don't, 1Password says so. Seeing a link in Consultainer doesn't give anyone access to the secret.
Who can do what
| Owner | Admin | Member | |
|---|---|---|---|
| Add, edit and remove credential links | Yes | Yes | |
| See links on a client | Yes | Yes | Yes |
| See links on a project | Yes | Yes | If they can see the project (for a confidential project, only people on it) |
Credential links never appear on anything the client sees — client and project share pages, invoices or estimates — and never in Slack or email alerts.
Copy the link to an item
Find the item
In the 1Password app or on 1Password.com, open the vault and select the item.
Copy private link
Click ⋯ (more actions) and choose Copy private link. The link looks like
https://start.1password.com/open/i?a=…&v=…&i=…&h=yourteam.1password.com.
A private link only works for people who already have access to the item in 1Password. Don't use Share — that makes a link anyone can open, and Consultainer refuses it.
Open the web vault
Go to vault.bitwarden.com, vault.bitwarden.eu, or your own server's address if you self-host Bitwarden or Vaultwarden.
Open the item
Click the item so it opens. For an item in an organization, open it from the organization's vault.
Copy the address
Copy the address from the browser's address bar. It looks like
https://vault.bitwarden.com/#/vault?itemId=….
The browser extension and the desktop and mobile apps don't give you a link to an item, so use the web vault. Bitwarden Send links are refused: anyone with one can read what was sent.
Open the item in your password manager's web vault and copy the address
from the browser. Consultainer recognises Keeper, Dashlane, LastPass and
Proton Pass by their web-vault addresses; any other https:// link is
shown as Other vault with an Open in vault button.
Use a link that only works for people with access. One-time or public share links carry the secret (or the key to it) in the link, so Consultainer refuses the ones it recognises.
Add a credential link
Owners and admins.
Open the client or project
A link added on a client's page is for the whole client (or pick a project in Project). A link added on a project's page is for that project.
Click Add on the Credentials card
Paste the link
Under Link to the item, paste the link you copied. The password manager it's from shows under the field.
Add a label and, if useful, a note
The label is what people look for, like Client AWS root. The note is for context, like "Break-glass only; ask Sam for vault access." Don't paste passwords, keys or tokens in either.
Pick a kind (optional) and click Add link
To change a link, click the pencil next to it. To remove one, click the bin; nothing changes in your password manager.
Check it worked: the Credentials card lists the label with the password manager's name and an Open in 1Password (or Open in Bitwarden, Open in vault, …) button. Click it: the item opens in your password manager in a new tab.
Using credential links
The Credentials card is on the client's page (with each project's links, labelled with the project) and on the project's page (with the client-wide ones, labelled Whole client). Members only see the card when there's something on it.
Credential links are also available read-only through the
API
(GET /api/v1/clients/{id}/vault-links) and the
MCP server (list_vault_links), with the same visibility
rules. There's no way to add or change them outside the app.
Adding, changing and removing links is recorded in the
audit log. The owner-only whole-organization
export includes them in vault-links; a
per-client export doesn't, since the links reveal how your vault is laid
out.
How secrets are kept out
Consultainer checks what you type before saving, and refuses:
- links that aren't
https:// - links with a username or password in them (
https://user:pass@…) - links with a parameter named like a password, secret, token or key
(1Password's
a,v,iandhare fine) - share links that hand out the item to anyone who has them (1Password share links, Bitwarden Send, Keeper one-time shares, Proton Pass public links)
- labels and notes that look like a credential:
password: …ortoken=…, AWS access keys (AKIA…), private keys (-----BEGIN … PRIVATE KEY-----), JWTs, well-known API token formats, and long random-looking strings
The check is a safety net, not a guarantee. If you paste a secret anyway, remove it, and rotate the secret in your password manager.
Troubleshooting
- "This looks like a secret. Paste the link to the vault item instead.": the link, label or note looks like it contains a password, key or token. Paste the item's link instead, and keep the label and note to plain descriptions. A long random-looking string (like an account key) in a note triggers this too.
- "That's a share link — anyone who has it can see the item. Copy the item's private link instead, so only people with access in your vault can open it.": in 1Password use Copy private link, not Share; in Bitwarden copy the item's web-vault address, not a Send link.
- "Only https:// links to a vault item can be added.": app links like
onepassword://and plainhttp://links aren't accepted. Copy thehttps://link from the web vault. - "Paste a full link to the vault item, starting with https://.": what you pasted isn't a link.
- "Only owners and admins can add or change credential links.": ask an owner or admin to add it.
- The item doesn't open, or the password manager says you don't have access: you're not signed in to that account, or you don't have access to that vault or item. Ask whoever manages the vault to share it with you. Consultainer can't grant access.
- A Bitwarden link opens the vault but not the item: you may be signed in to a different account, or the item has moved to another organization. Open the item again and replace the link.