Email support
What to include
- Keyhelm and iOS versions
- The exact Vault version and edition, when known
- The authentication method, screen, and action involved
- The message shown and steps to reproduce it
Never include Vault tokens, passwords, JWTs, wrapping tokens, one-time codes, secret values, or unredacted policy source. Remove sensitive server addresses, namespace names, secret paths, and organization details from screenshots. Use fictional examples when describing a path or namespace.
Connection and sign-in problems
Check that your iPhone can reach Vault over the appropriate LAN or VPN and that Vault is initialized and unsealed. Confirm the server address, auth mount, and role with your administrator. Keyhelm currently uses the root namespace; named namespaces and HCP Vault Dedicated are deferred. Available sign-in methods depend on the server’s configuration. OIDC browser sign-in requires the callback registered by your Vault administrator.
Permissions and data changes
A successful sign-in does not grant access to every engine, secret, policy, or operational API. Ask your Vault administrator to check the token’s permissions. If a write reports an uncertain outcome or a version conflict, inspect the current server state before retrying. Keyhelm is not a server backup or disaster-recovery service.
Purchases
Use Restore Purchases while the workspace is locked or in Settings to recover eligible purchases. For an active subscription, open Plan in Settings to manage it through your Apple account. Pro access does not sign you in to Vault or change server permissions. Development and test builds use simulated RevenueCat Test Store purchases; no real money is charged, and test access does not transfer to an App Store purchase. Never send payment-card details to support.
Product boundary
Keyhelm focuses on KV v1/v2 and supported Cubbyhole workflows, read-only ACL policy inspection, permission-aware server information, and selected tools. It does not administer namespaces, auth methods, MFA enrollment, identity, leases, or seal/unseal operations. Specific server versions and identity-provider configurations require their own compatibility verification. Named namespaces and HCP Vault Dedicated support are deferred.