this card allows grok bot to store credentials securely in a vault! when the credential is needed, it goes through a special access path where its never exposed to the model in plain text

later when you say "file a bug that login is broken", the bot turns that into a linear call with just the title (no token). the host knows that tool call is linear's, looks up this agent's linear api key, and builds the real http request. linear creates it, and the bot gets back "sent it, we're good". the host where the final tool call is constructed is also the only place the credential shows up

here's roughly how it works