> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beta.b3os.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault limits and FAQ

Size limits for vault connections and secrets in the beta, and answers to common questions about how credentials are stored, injected and rotated.

## Limits

| Limit | Value |
|---|---|
| Bound hosts per custom connection | 8 |
| Connection request body | 64 KiB |
| `api_key`, `password`, `client_secret` | 8 KiB each |
| `token`, `access_token`, `refresh_token` | 16 KiB each |
| `label` | 80 characters |
| `subject` | 256 characters |
| Connections per sandbox grant | 16 |
| Connections named in one action call | 8 |

## FAQ

**Can I read a secret back?**

No. Secret fields are write-only: the API returns their names, never their values, and never logs them. To change one, write a new value with `PATCH`.
  **Where is the credential added to a request?**

At the egress proxy on the node, after the request leaves the action, routine or sandbox and before it goes out to the service. It is added only when the destination is one of the connection's hosts.
  **What is a verification-only connection for?**

Holding a secret that B3OS checks but never sends, such as the signing secret a provider uses for webhooks to a routine. It has no hosts, so it is never injected into any request.
  **Can one project hold several connections for the same pack?**

Yes, for example one per end user with `subject`. Name the one you want in each call; when you leave it out, B3OS uses the project's only connection for that pack and key, and a routine step uses the most recent one the run may use.
  **Why do I get vault_unavailable?**

The node's vault has not loaded its key yet, usually just after a restart. Retry shortly; operations that need credentials fail until it has.
  **Can I connect an OAuth app through B3OS?**

Not in v0.1. Store an access token you obtained yourself as an `oauth2` connection. Hosted consent links are planned.