diff --git a/TOOLS.md b/TOOLS.md
index 6bdc8a6..08bd5f7 100644
--- a/TOOLS.md
+++ b/TOOLS.md
@@ -42,3 +42,66 @@ Add whatever helps you do your job. This is your cheat sheet.
 ## Related
 
 - [Agent workspace](/concepts/agent-workspace)
+
+---
+
+## Beawit Vault (beavault)
+
+**URL:** https://beavault.beawit.net:8200  
+**Purpose:** Centralized secret management for all API tokens, credentials, and sensitive configuration
+
+### Accessing Vault
+
+Vault uses AppRole authentication. Credentials are stored in:
+- `/home/jcbeasley/Documents/vault-approles.txt`
+
+### Authentication
+
+```bash
+# Get vault token using automation role
+curl -sk -X POST \
+  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
+  "https://beavault.beawit.net:8200/v1/auth/approle/login" | jq -r '.auth.client_token'
+```
+
+### Reading Secrets
+
+```bash
+VAULT_TOKEN="<token_from_above>"
+curl -sk -H "X-Vault-Token: $VAULT_TOKEN" \
+  "https://beavault.beawit.net:8200/v1/kv/data/api/<category>/<key>"
+```
+
+### Vault Structure
+
+Secrets are organized under `kv/data/api/`:
+
+| Category | Contents |
+|----------|----------|
+| `ai-ml` | DeepSeek, Groq, OpenRouter, Mistral, etc. |
+| `infrastructure` | NocoDB, Metabase, Qdrant, Odoo, Gitea, etc. |
+| `integration` | N8N, HomeAssistant, Skybox, Tavily |
+| `business` | Stripe, Apollo, Hunter, Kimai, InvoiceNinja |
+| `external` | Email, SnipeIT, FreePBX, SearXNG |
+| `communication` | Discord, Twitter, Uptime Kuma |
+| `monitoring` | Uptime Kuma, SpeedTracker |
+| `search` | SerpAPI, Firecrawl, ImageRouter |
+| `media` | Pexels, YouTube, Freepik, JSON2Video |
+| `credentials` | DB configs, collection names, paths |
+
+### Service-Specific Access
+
+For read-only access to specific paths, use the appropriate service role:
+
+- `svc-ai-ml` - AI/ML services
+- `svc-infrastructure` - Infrastructure services  
+- `svc-business` - Business services
+- `svc-communication` - Communication services
+- `svc-monitoring` - Monitoring services
+- `svc-media` - Media services
+- `svc-search` - Search services
+- `svc-integration` - Integration services
+- `svc-external` - External services
+- `svc-credentials` - Credential configs
+
+See `/home/jcbeasley/Documents/vault-approles.txt` for role IDs and secret IDs.