How to store portal passwords in the credentials vault

What is it for?

The vault stores the passwords of the Tax and Customs Authority (AT), Social Security and bank portals, and also the keys of payment and AI services, encrypted and per company. Nobody sees a password without permission and every reveal is logged.

When to use it?

• In a new company, to start the vault and give the first permissions.
• So that the accounting firm stops keeping client passwords in spreadsheets.
• To share access to a portal with a colleague without telling them the password.
• Do not use the vault for the AT web service credentials: those have their own screen, in Accounting › Configure › Certified invoicing › Tax Authority credentials. See How to connect fiscaldoo to the Tax and Customs Authority.

Where to find it?

Accounting › Configure › Credentials vault, with three menus for Fiscal administration: Credentials, Permissions and Start the vault. The system administrator only sees Credentials.

Before you start

• Do the steps with a user with the Fiscal administration profile who has the company among their companies. Steps 1 to 6 were done with that profile, on 3 November 2026, in a new demo company (Empresa Nova Exemplo, Lda), with fictitious data.
• The system administrator gives the profile, in Settings › Users & Companies › Users: open the person's form, Advanced settings tab, PT LOCALIZATION group, field PT Localization — Invoicing, accounting and tax levels, choose Fiscal administration and save. The Profile tab does not have this option. See Profiles and permissions.
• The system administrator does not start the vault or give permissions: they do not have those menus. They create and replace credentials, but never reveal a stored password.

How to use it

1. Check, in the top right corner, that you are in the right company. Open Accounting › Configure › Credentials vault › Start the vault. The Start the credentials vault window explains: “Nobody has “Edit” in the credentials vault of this company yet, so nobody can give permissions or store credentials. If you confirm, you RECEIVE “Edit” on all the portals of this company, only once, and it is recorded in the audit log (who, when, which company).…”. If someone in the company already has Edit, do not start the vault: ask them for the permission.
2. Click Confirm. Vault permissions opens with one line: your user, the company, Portal empty (all portals) and Level Edit.
3. To give access to another person, in Permissions, click New and fill in the line: User, Company, Portal (empty for all portals, or a single portal) and Level: None, View or Edit. Click Save. The Warning column reminds you, for View and Edit: “Can read the passwords in clear text. Recorded in the audit log.”.
4. Open Credentials and click New. Type the Description (“Portal de demonstração (fictício)”), check the Company, choose the Portal and type the User name and the Password / secret. Click Save.
5. To see the password, click Reveal secret. The Confirmation window warns that “Revealing the secret is recorded in the audit log (who, when, which credential and company). You will be asked for your password again.”. Click Confirm, type your password in Access Control and click Confirm password. The password appears on screen: “Secret of Portal de demonstração (fictício) (shown for 60 seconds).”, followed by the password.
6. To change or remove an access, go back to Permissions. To change it, click the line's Level, choose another and click Save. To remove it, tick the line and click Actions › Delete and, in the confirmation window, Delete.

Expected result

• The credential appears in Credentials with Has a secret. The form says “The secret is stored encrypted and is never shown here. Only people with permission can reveal it, and every reveal is recorded.”.
• Permissions shows who has access to each company and portal, and at what level.
• Audit › Records › Access log holds the events Vault: permission changed (the start of the vault and each permission given, changed or removed), Vault: secret created, Vault: secret revealed and Vault: access denied, with the date, the user and the company.

Important notes

• Starting the vault is once per company. From then on, only those with Edit in that company give, change or remove permissions.
• Nobody changes their own access, not even whoever started the vault. To change the access of a person with Edit, you need another person with Edit in the same company.
• The levels: None does not see the credentials; View sees them and reveals the password (always logged); Edit also creates, changes and deletes credentials and gives permissions to others. Give Edit only to those who manage the credentials.
• The Accountant does not have the Credentials vault menu, even with the View permission.
• The vault has a limit: whoever installs modules, uses the server console or accesses the database has full power over the installation, and the screen says so.
• In a test environment the portal does not open from the vault (“so that no real credential is used in tests”).
• The Copilot key is also stored here (“Copilot AI key”): see How to connect the Copilot to an AI provider.

Common problems

“Access Error” when revealing the secret as system administrator

• Message: “The technical administrator sets, changes and tests the credentials, but never sees a saved secret: it is write-only. To use the credential, open the portal; to change the secret, type a new one.”. It appears after Reveal secret › Confirm, without asking for the password.
• Cause: the system administrator only writes to the vault; they never read.
• What to do: to change the password, type a new one in the credential and save. To see it, use a user with the View permission for this company and portal.

“You do not have permission to create, change or delete these credentials…”

• Cause: you have View, but not Edit, in this company and portal. With View, you open and reveal, but cannot save changes.
• What to do: click Close, discard the change and ask someone who already has Edit for Edit.

Other vault refusals

“You do not have permission to see these credentials…”, “Only who has “Edit” in the credentials vault of company…”, “You cannot give yourself, change or remove your own access…” and “The vault of company … is already started…”: see I do not have permission to see, use or change a vault credential.