API connections and the vault

A connection is an upstream HTTPS API that Claude can call with a secret it never sees — the engine or the probe injects the credential at call time. You register connections from the dashboard’s Connections page (the browser counterpart of the store_connection / connection_egress tools).

What a connection holds

A label and a system (r1, sz, cp, or generic).
An endpoint host and port.
An auth-injection kind — bearer, basic, header, or query.
An optional flag to tolerate a self-signed TLS cert (for on-prem controllers).
A storage mode for the secret (below).

Storage modes

Where the secret lives decides what the connection can reach and how it survives a probe outage:

Mode	Where the secret lives	Reaches	Survives probe offline?
`cloud`	AES-256-GCM-encrypted in the cloud	Public endpoints only	Yes
`probe_vault`	Sealed end-to-end to the probe, on the probe only	LAN endpoints too	No
`probe_vault_fallback`	Probe vault plus a standing encrypted cloud copy	LAN + public	Yes

Use probe_vault when the credential must never leave the LAN and the target is a private/on-prem controller. Use cloud for public SaaS APIs. Use the fallback mode when you want LAN reach but also want egress to keep working if the probe drops.

The post-quantum probe vault

When you provision a probe_vault secret, your browser fetches the probe’s hybrid recipient keys (P-256 ECDH + ML-KEM-768), seals the secret locally, and posts only ciphertext. The cloud relays the sealed envelope to the probe and never sees the plaintext. On the probe, vault secrets are held encrypted with AES-256-GCM.

Break glass — temporary cloud access

A pure probe_vault connection stops working when the probe is offline, because the secret only exists on the probe. Break glass pushes an explicit, time-boxed encrypted cloud copy so connection_egress keeps working during an outage.

You trigger it from the dashboard with a TTL — 15, 30, or 60 minutes (60 is the max).
The copy is treated as gone the moment it expires, and a background sweep purges expired copies.
Break glass is a dashboard-only action (session-authenticated browser → engine). It is deliberately not an MCP tool, so secrets never pass through the model channel.