agentos.guide › blog

Hermes Vault: Save Logins, Auto-Fill 2FA And Move The Key To Your Keychain In Your Agent OS With Five Copy-Paste Prompts

By Julian Goldie · 3 November 2026 · agentos.guide

The Hermes vault is how your Agent OS signs into websites for you: logins, 2FA codes, cards and addresses go into the page, and the model only learns that a field was filled.

Hermes v0.22.6, released on 2 November 2026, adds an opt-in way to keep the vault's key in your operating system's keychain.

Below is a two-minute quick start, five prompts to paste into your agent, and a weekly routine that keeps the vault tidy.

Want help choosing which accounts your agent should handle? Book a free SEO strategy session.

Where The Vault Sits In Your Agent OS

Your Agent OS runs Hermes across chat, the Desktop app and scheduled jobs, and each profile has its own vault under ~/.hermes/vault/.

The agent can see labels, site origins and usernames, so it knows which login to reach for.

It can't see passwords or card numbers; the official Passwords & Logins page says they leave the vault only to go into the page.

Each fill is refused unless the page's origin exactly matches the saved one.

Members of the AI Profit Boardroom get the installable Agent OS, so the profiles these vaults live in are already set up.

Quick Start: Your First Saved Login

There's nothing to switch on.

1. Update: hermes update on the CLI, or the :stable Docker image.
2. Ask your agent to log into a site you use.
3. When it reaches the sign-in page, a masked "Save login" prompt (or a "Save your … login?" card on Desktop) appears.
4. Type the username and password there, never in the chat.
5. Choose Save & sign in.

From then on, the agent signs in on its own.

Desktop copies installed from the .exe or .dmg get the v0.22.6 changes with the next bundled release, according to the release notes.

What Your Agent Sees After A Fill

This is worth knowing before you write prompts, because it shapes what you can ask for.

When the agent fills a login, the tool result it gets back is a field count and the site origin.

The password is also registered with the redactor, so if the agent reads the page afterwards, the password can't be echoed back into the chat.

So never ask your agent to "show me the password" or "copy my login into this note".

It can't, and that's the point.

Ask it to list labels, origins and usernames instead, which is exactly what Prompt 1 does.

Two-Factor Codes Without Leaving The Chat

Three kinds of second step, three behaviours.

• Authenticator apps: save the site's setup key or otpauth:// link with the login, and Hermes generates and enters the code itself. The item shows a 2FA auto badge.
• Codes by text or email: a small verification prompt pops up, you type the code, and Hermes enters it.
• Passkeys, hardware keys and app approvals: the agent asks you to finish on your device and waits.

To store a setup key, open the Desktop's Passwords & Logins screen under Settings and press Add, or run hermes vault add from a terminal.

TOTP seeds stored in 1Password or Bitwarden items count too.

Prompt 1: Audit What The Vault Holds

Start every new Agent OS with a clear picture.

Run these and summarise the results in one table:
hermes vault list
hermes vault sources
hermes vault key
Columns: item label, site origin, type (login / 2FA / card / address),
and source (Hermes vault, 1Password or Bitwarden).
Under the table, tell me where the vault key is stored and whether
a keychain is reachable on this machine. Do not show any secret values.

Read the table, then delete anything stale with hermes vault rm <handle>.

If a manager you don't want shows up under sources, switch it off with hermes vault sources --disable bitwarden or the toggle in Settings.

Prompt 2: Log In The Safe Way

Give the agent one rule it follows on every site.

Log into [site] and open [page].
If there is no saved login for this site, stop at the sign-in page
and use the Hermes save-login prompt so I can type it there.
Never ask me to paste a password, card number or code into the chat.
If the site asks for a code sent to my phone or email, wait for the
verification prompt. If it needs a passkey or app approval, tell me
and wait until the page moves on.

That matches how the vault handles each sign-in route, so you never end up with a password in the chat history.

🔥 Want this running inside a ready-made Agent OS?

The AI Profit Boardroom gives you step-by-step video trainings, the installable Agent OS, four coaching calls a week and 3,400+ members to compare notes with.

→ Join the AI Profit Boardroom

Prompt 3: Move The Key Into The Keychain

This is the v0.22.6 step, and it's opt-in for a reason.

Run hermes vault key and tell me where the vault key is and whether
a keychain is reachable.
If a keychain is reachable and this is my own computer (not a server
that runs jobs while I'm logged out), run:
hermes vault key migrate --to keychain
Then run hermes vault key again and confirm the key moved.
If no keychain is reachable, stop and tell me why.

Which keychain? On a Mac it's Keychain, on Windows it's Credential Manager, and on Linux it's KWallet or the Secret Service.

The move only deletes vault.key after it has checked that the keychain copy opens the vault, so a cut-off run is safe to repeat.

Before moving this profile to another computer, run hermes vault key migrate --to file, because backups and copies no longer carry the key.

One more thing to know: if the keychain entry is ever deleted, Hermes won't open the vault or quietly make a new key over it.

You'd restore the entry from a keychain backup, or delete vault.json.enc and start the vault again.

Prompt 4: Check Scheduled Jobs That Need Logins

Cron jobs, webhooks, the API server and hermes chat -q can't answer a prompt.

List my scheduled jobs that open a site needing a login.
For each one, tell me:
- whether the login is in the Hermes vault or in 1Password/Bitwarden
- whether it would hit unavailable_in_this_session (locked manager)
  or prompt_unavailable (no saved login)
- whether it tries to fill a card (those are refused in headless runs)
Suggest the fix for each, but change nothing until I say yes.

Saved local logins keep working in those runs.

The two error codes in the prompt are the ones the docs list, so your agent can search its job logs for them directly.

Fix them from an interactive session: unlock the manager there, or let the agent reach the sign-in page once so you can save the login.

For 1Password, a service account token in OP_SERVICE_ACCOUNT_TOKEN covers unattended jobs.

On a Mac in keychain mode, jobs that run while you're logged out can't read the key, so keep the file key on that machine if your scheduled jobs log in overnight.

Prompt 5: Fence Off Unreviewed Plugins

The docs single plugins out, because an in-process plugin has the same reach as Hermes, right down to using your saved logins.

List every plugin installed in this profile and mark which ones
I installed from outside the official catalog.
If any are unreviewed, show me the config change to set
plugins.isolation: host, and explain what plugins.host.launcher adds.
Do not apply the change until I confirm.

The full setting is on the plugins page.

Cards, Addresses And The Approval Rule

Every card fill asks you first, with the same prompt as a dangerous command.

Decline and nothing is written.

Address fills go straight through.

Because headless sessions can't approve, an instruction hidden on a checkout page can ask but can't spend.

So a scheduled job can fill a basket, and a person still finishes every purchase.

📞 Planning which logins your Agent OS should hold?

Book a free SEO strategy session and my team will help you decide what to automate and what stays with you.

→ Book your free session

Using The Vault With Camofox

If your Agent OS browses through the Camofox plugin, fills still work over its REST evaluate endpoint.

They only go through when CAMOFOX_URL is loopback or HTTPS.

Our Hermes Camofox guide covers running that browser in your Agent OS.

The Weekly Vault Routine

1. Monday: run Prompt 1 and remove logins you no longer use.
2. After any new plugin install: run Prompt 5.
3. After adding a scheduled job that logs in: run Prompt 4.
4. After a Hermes update on a Mac: if macOS asks whether Hermes may use the keychain entry, allow it.
5. Before a new laptop: move the key back to a file, copy the profile, then migrate again.

Run one vault per client or project by giving each its own profile.

Want coaching while you set it up? Join the AI Profit Boardroom.

FAQ

Can my agent run the keychain migration itself?

Yes. Prompt 3 has it run hermes vault key, migrate only if a keychain is reachable on your own computer, then confirm with hermes vault key.

Will my overnight jobs still log in?

Saved local logins keep working in cron and webhook runs. Locked password managers, missing logins, card fills and, on a logged-out Mac, keychain keys are the exceptions.

Where do I see saved logins on Desktop?

Settings, then Passwords & Logins. It lists everything saved and any detected password managers with Unlock and Lock.

Does each Agent OS profile share one vault?

No. The vault is scoped to the profile, and in keychain mode each profile gets its own keychain entry.

Final word on Hermes Vault

Paste Prompt 1 into your agent now, and book a free strategy session if you want a plan for which accounts go into your Hermes vault.

Related guides on agentos.guide

→ Hermes Camofox: Set Up And Run The Stealth Browser Plugin In Your Agent OS With Five Copy-Paste Prompts

→ Hermes Webapp: Run Your Agent OS From A Browser

→ Hermes Agent Hooks: Add Guardrails, Turn Blocks And Dashboard Events To Your Agent OS With Five Copy-Paste Prompts

→ Migrate Grok Bot To Hermes: Paste, Import, Run In Your Agent OS

📺 Video notes + links to the tools 👉

🎥 Learn how I make these videos 👉

🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉

← all guides on agentos.guide