Integrations & Keys
Approve keys, browser origins, webhooks, and AI-agent handoffs safely.
Integrations & Keys
Use this page before sharing credentials, approving browser origins, or asking an AI agent to work with the workspace.
This is the operating handoff hub. Use Authentication & Keys for app configuration. Specialist implementation references are Payments, Membership, Embedded Admin, and External Effects under Build & Reference. A P0 app task does not approve credential sharing or launch.
Credential Ownership
A tenant-admin of the selected workspace or a platform super-admin manages workspace Secret Keys and integration settings. tenant-editor and tenant-viewer cannot manage those settings. Customer sessions are a separate end-user identity.
| Item | Authority and boundary | Operating handoff |
|---|---|---|
Publishable Key (pk01_) | Public workspace identifier for admitted public reads and specifically customer/capability-authorized operations; no operator authority | Approve browser origins; never use it as proof of private write permission |
Secret Key (sk01_) | Workspace service credential with granted scopes; no user/customer identity | Store only on trusted servers; record owner, expiry, replacement and revocation plan |
Personal access token (pat01_) | Operator identity with live membership/role, pinned to one workspace at issuance | For operator tooling, not an app service credential; never use X-Tenant-Id to retarget it |
| AI-agent handoff | A bounded task under the operator's existing authority | Share only required context; keep credentials out of prompts and public artifacts |
Raw Secret Keys and personal access tokens are revealed only once. Store them securely at issuance; they cannot be retrieved later. If a Secret Key is lost or compromised, issue a replacement and update its consumers, then revoke the old key; suspected exposure needs immediate containment and revocation. The Publishable Key is server-derived and has no current rotation flow; contact support about identifier concerns rather than editing it.
Browser Origin Checks
- Add only approved browser origins before public browser calls depend on the workspace. Review production, staging, and preview separately, and remove obsolete origins.
- API CORS origins, preview destinations, and customer OAuth client origins/redirects are separate settings; configuring one does not configure the others.
- Configure any third-party website analytics in your own frontend and with that vendor.
Webhook And Handoff Ownership
- Name who owns webhook delivery failures.
- Name who can rotate credentials after vendor offboarding.
- Keep AI-agent tasks bounded to the workspace and feature area under review.
- Send technical owners only the credentials and context they need.
Secret Key rotation is an admin responsibility. Rotate immediately after suspected exposure, vendor offboarding, or unclear ownership.
Next Actions
- Confirm access owners in Workspace Setup.
- Use Launch Readiness to check keys, CORS, and webhooks before launch.