Keys and secrets

Keys

The Keys card lists the services connected on your account, like Stripe, OpenAI or Shopify, that your apps can use, with a count. It shows every enabled connection on the account, not only this app's. Pressing it opens Connectors, where you add them once and choose which apps use each.

Secrets

Keys for services the app calls that have no connector: a weather service, SMS, a client's own API. It is in the menu under Cloud, and needs someone who can edit the app. Press Add secret, give it a name and the address of the service, and paste the key.

• The key is sent only to that address, never anywhere else, and never sits in the app's code.
• It is stored encrypted. After saving it can be replaced or deleted, not read.
• A change applies at once, in the preview and in the published app, without publishing again.

Then ask for it in the chat by name: "Show the weather in Paris using WEATHER_KEY". The app writes the name where the key goes, and Setherion puts the key in on the way out. Each request with a secret uses one integration credit. Apps on your own Supabase cannot use secrets yet.

Rules for a secret

• The name is capital letters, digits and underscores, starting with a letter, 2 to 64 characters, like WEATHER_KEY. A name that has a key inside it is refused, and so is a name already in use: replace the old one from its menu.
• The value can be up to 4,096 characters, and an app can hold 50 secrets.
• The service address must be a public https address. IP addresses, localhost, ports and private names are refused. If you paste a whole link, only its host is kept.
• A request is sent only if its address is the one saved with the secret. Otherwise it is refused with a message that the secret can only be sent to that host.
• The key is removed from the answer before the app sees it.
• A request waits up to 30 seconds, is not redirected, and the answer can be up to 5 MB.
• A visitor can make up to 600 such requests an hour. They stop while the backend is paused or the monthly allowance has stopped.
• The table shows each secret's name, the address it is sent to and when it was updated, with Replace and Delete on each row.