Grok Bot Vault: save logins, cards, and contact info safely (unofficial guide)

The short answer

Save logins and contact info in Vault so your Bot stops asking you to sign in or retype your address. Think twice before saving a card: a saved card can be filled in at checkout without a separate approval each time.

Your Bot never sees a saved password, card number, or security code. It can see your contact info and the list of logins you saved, so it can pick the right one.

This guide is independent and unofficial. It isn't affiliated with or endorsed by xAI, Grok, or Cursor. Features change, so check the linked help page for the current details.

What Vault holds

Logins: a website, a username or email, and a password. Your Bot uses a saved login to sign in on that website.

Cards: the number, expiry, security code, name on card, and billing address.

Contact info: names, addresses, phone numbers, and emails for shipping and billing.

Vault covers your whole account. Everything you save is available to every Bot you have, and you can't limit an item to one Bot. If you run several Bots, decide what you're comfortable with all of them using.

Vault isn't supported on Team Bots. For a Team Bot, keys go under the Bot's Secrets instead.

How to add a login, card, or contact info

Open Settings → Vault, choose New item, and pick Login, Card, or Contact info.

For a login, enter the Website, Username or email, and Password, then choose Save login. For a card, choose Scan with camera or Upload a photo to fill it from the card, or type it in, then choose Save card. For contact info, enter the name, address, phone, and email, then choose Save contact info.

Use Hints to tell your Bot when to use an entry, for example "Use for work purchases". Your Bot follows the hint when it chooses between entries, which matters if you have a personal and a business card or two logins for one site.

You can also save from a chat. When your Bot asks for a login, card, or address with a Secure Form, check Securely save to Bot's vault to keep it. Leave it unchecked and the value stays only in that chat and expires on its own. When you attach a photo of a card, Grok Bot offers Save to Vault.

Import logins from 1Password, Chrome, or another password manager

On desktop you can import logins from a CSV export from 1Password, Chrome or Edge, Safari or Apple Passwords, Firefox, Bitwarden, or LastPass.

In Settings → Vault, choose New item, then Import from CSV…, then Choose CSV file. The help page says the file is read on your computer and never uploaded, and it must be under 5 MB.

Review the list before importing. Items already in Vault are skipped, and rows with an error, such as a missing password or a website that isn't https, aren't imported. LastPass exports bring cards along too.

The exported CSV holds your passwords unencrypted. Delete it as soon as the import finishes, and empty your trash.

You don't have to import everything. Bringing in only the sites you actually want your Bot to use keeps the list short and the risk smaller.

How your Bot uses what you saved

Signing in: your Bot tries a saved login first, then a connected password manager such as 1Password. If neither has it, it asks you with a Secure Form.

New accounts: if you let your Bot pick the password when it signs up for a site, Vault generates the password and saves the login. Your Bot never sees it.

Checkout: saved cards fill in at checkout, and contact info fills in shipping and billing details.

Details you share in chat: when you give your Bot a name, address, phone number, or email, it saves it as contact info once the task is done and tells you what it saved. Tell it if you don't want something kept.

Your Bot can change contact info and an entry's nickname and hints when you ask. Passwords, usernames, websites, card numbers, and security codes change only in Settings → Vault, and logins and cards are removed only there.

Vault doesn't get you past everything. Two-factor codes, passkeys, CAPTCHAs, and payment confirmations are still steps the docs say you complete yourself with Take over.

Should you save a card?

This is the decision that matters most. The help page is direct about it: saving a card lets your Bots fill it in at checkout, and there's no setting that requires your approval each time a saved card is used.

If you want to approve every payment yourself, don't save the card. When your Bot asks for a card with a Secure Form at checkout, leave Securely save to Bot's vault unchecked, and the card is used only in that chat. A form without that checkbox saves straight to Vault, so don't submit it if you don't want the card kept.

If you do save one, a sensible middle ground is a card you'd be comfortable having used without asking, such as a virtual or low-limit card from your bank, with a hint that says exactly what it's for. Telling your Bot "ask me before any purchase" is a good instruction, but it isn't the same as an approval control.

If you already saved a card and change your mind, open Settings → Vault, select it, and choose Remove. After that Grok Bot can no longer pay with it.

API keys and other secrets go somewhere else

Vault is for logins, cards, and contact info. For an API key or any other secret, use the secure secret card when a Bot asks for one. The field is masked, you choose Save securely, and the value isn't written into the chat.

On a Team Bot you own or manage, add keys under the Bot's Secrets. Those are used in every teammate's chat, so only add keys you're happy for everyone who can chat with that Bot to use.

Saved values are write-only. In Vault, passwords stay hidden and cards show only their last four digits, so a blank field isn't a sign something was deleted.

Never paste passwords, codes, or keys into ordinary chat, Shell, or a file on the Bot's computer, and don't type them during a Teach a task demonstration. Computer updates, Recover, and Reset can remove things stored in files, but they don't touch what's saved in Vault or with the secure card.