Docs · Connect your tools
Connect Bitwarden
StackWeaver reads, and never changes, one read-only endpoint on your Bitwarden organisation once a day, through an organisation API credential you create yourself. This guide says exactly what is read, which permission the credential needs, how to create one, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver exchanges the client id and secret you paste for a short-lived access token, then calls Bitwarden's public API. The result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including a result that fails.
| Check (as shown in the portal) | What it looks at |
|---|---|
| Client credential valid and reachable | Whether the stored client id and secret are accepted and your organisation's collections list responds with collection names and ids. Evidence only: no threshold is applied. |
2. What it does not do
- It never reads an individual vault item. Bitwarden's public API does not allow reading or managing vault item contents at all; only collection names and ids are available.
- It cannot change anything: the credential is used for one read-only endpoint.
- It does not say your secrets-management programme meets any requirement. A result is what Bitwarden returned at a certain time.
- It needs an organisation API key, which Bitwarden only offers on a Teams or Enterprise organisation plan — Free and Families-tier organisations do not have this feature. A personal/individual API key (starting `user.`) is a different credential for a different, personal-vault-only scope, and will not work here.
3. The access it needs
Two values from one organisation API credential: a client id (`organization.<uuid>`) and a client secret, exchanged for an access token over OAuth2 client credentials with scope `api.organization` (Bitwarden).
Who can connect. In StackWeaver, a workspace owner or admin pastes the credential. Only an owner or admin of the Bitwarden organisation can view that organisation's API key.
4. Connect steps
- In a desktop browser, sign in at vault.bitwarden.com and switch from your personal vault to the organisation.
- Open Settings → Organization Info and press View API Key (you may be asked for your master password). This is an organisation-level screen, not your personal account's API key.
- In StackWeaver, open Evidence, the Bitwarden section, and paste the client id and client secret. Type "eu" in the region field if your organisation is on the EU cloud, or leave it empty for the default (US) cloud.
- Press Test connection.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check, or the feature needs a plan StackWeaver could not confirm |
| Could not check | StackWeaver could not read the data, or the check needs a higher plan than the account has |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Bitwarden section. StackWeaver deletes the stored credential.
- In Bitwarden's organisation settings, rotate the API key yourself — StackWeaver has no way to ask Bitwarden to revoke a credential on your behalf.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| Check Organization client ID: From your organisation's API Key settings, in the form organization.xxxxxxxx-xxxx-... | You pasted a personal (`user.`) API key, or the wrong format. Switch to the organisation in Bitwarden's web vault first, then Settings → Organization Info → View API Key |
| Bitwarden refused the client id or secret: they may be wrong or revoked | Check both values were copied in full, and that the region field matches your organisation's cloud (US or EU) |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.