> For the complete documentation index, see [llms.txt](https://docs.baas.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.baas.sh/dashboard/vault.md).

# Vault

Add the keys your project signs with, and prepare them on every network.

The **Vault** holds the keys that sign the transactions BaaS sends for you. Add a key here, then pick it in the Console wherever a transaction is sent.

## Open the Vault

In the **BaaS Dashboard**, open your project's detail page. Click the **⋮** (three-dot) menu in the project header, then choose **Vault**. The page lists the project's keys.

## Add a key

Click **Add key** and choose a provider:

| Provider             | What it is                                                                                                 | Use it for  |
| -------------------- | ---------------------------------------------------------------------------------------------------------- | ----------- |
| **Local**            | A private key generated or imported here, held by BaaS                                                     | Development |
| **Google Cloud KMS** | A key in your Google Cloud project, existing or created for you. The private key never leaves Google Cloud | Production  |

The **Key name** is the key's id everywhere, from the Console to the CLI. Choose it once: 1 to 25 characters (letters, digits, `-` and `_`), unique in the project, and it can't be changed afterwards.

Once added, the key is prepared on every network of the project.

If a network couldn't be prepared, the page reads **Key added. Some networks couldn't be enabled.** Click **Retry**: it prepares the missing networks only and never recreates the key.

{% hint style="info" %}
**On a public network, fund the key's address** so it can pay for gas. On the BaaS network, gas is free. The address is on the key's activity page in the Console's [Vault](/baas-console/vault.md).
{% endhint %}

## Remove a key

Removal is refused while a workflow action, a Smart Wallet setting, or the [consensus](/dashboard/blockchain-settings.md#consensus-keys) still uses the key: the Dashboard names them. Pick another key in the action or in Wallet Settings first.

In the Vault, open the **⋮** menu on the key:

| Action                    | What it does                                                                                                                                                                                                                                                                    |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Remove key**            | Drops the key from every network, then the key itself. A local private key is gone for good. A Google Cloud KMS key is never destroyed: it stays in your Google Cloud project. BaaS then asks Google for permission to clean up the service account and IAM binding it created. |
| **Delete key everywhere** | For a Google Cloud KMS key created by BaaS: the same, and the key version BaaS created is destroyed in that cleanup.                                                                                                                                                            |

A confirmation asks you to type the key's name. If the removal fails, the key stays in the Vault and you can retry. If the Google Cloud cleanup fails, or you close the Google window, the key is already gone from the Vault: import it again and remove it once more, or clean up in your Google Cloud project.

## Next

* [Vault](/baas-console/vault.md) in the Console: choose the networks each key can be used on, and follow its balance and activity.
* [Add your first key](/baas-cli/deploy.md#add-your-first-key) and deploy a contract with the CLI.