Integrations & Keys
Approve keys, browser origins, webhooks, and AI-agent handoffs safely.
Use this page before sharing credentials, approving browser origins, or asking an AI agent to work with the workspace.
This is the operating handoff hub. Use Authentication & Keys for app configuration. Specialist implementation references are Payments, Membership, Embedded Admin, and External Effects under Build & Reference. Even after an app task guide is complete, confirm authority and owners on this page before sharing credentials, and run Launch Readiness before launch.
Credential Ownership
A tenant-admin of the selected workspace or a platform super-admin manages workspace Secret Keys and integration settings. tenant-editor and tenant-viewer cannot manage those settings. Customer sessions are a separate end-user identity.
| Item | Authority and boundary | Operating handoff |
|---|---|---|
Publishable Key (pk01_) | Public workspace identifier for allowed public reads and specifically customer/capability-authorized operations; no operator authority | Approve browser origins; never use it as proof of private write permission |
Secret Key (sk01_) | Workspace service credential with granted scopes; no user/customer identity | Store only on trusted servers; record owner, expiry, replacement and revocation plan |
Personal access token (pat01_) | Operator identity with live membership/role, pinned to one workspace at issuance | For operator tooling, not an app service credential; never use X-Tenant-Id to retarget it |
| AI-agent handoff | A bounded task under the operator's existing authority | Share only required context; keep credentials out of prompts and public artifacts |
Raw Secret Keys and personal access tokens are revealed only once. Store them securely at issuance; they cannot be retrieved later.
If a Secret Key is lost or compromised, issue a replacement and update its consumers, then revoke the old key; suspected exposure needs immediate containment and revocation.
To revoke one of your own personal access tokens, select the profile icon (Account) at the top right of Console and use Personal access tokens. Match the token by the first 12 and last 4 characters shown in the list.
The Publishable Key is server-derived and has no current rotation flow; contact support about identifier concerns rather than editing it.
Browser Origin Checks
- Add only approved browser origins before public browser calls depend on the workspace. Review production, staging, and preview separately, and remove obsolete origins.
- API CORS origins, preview destinations, and customer OAuth client origins/redirects are separate settings; configuring one does not configure the others.
- Configure any third-party website analytics in your own frontend and with that vendor.
Webhook And Handoff Ownership
- Name who owns webhook delivery failures.
- Name who can rotate credentials after vendor offboarding.
- Keep AI-agent tasks bounded to the workspace and feature area under review.
- Send technical owners only the credentials and context they need.
Secret Key rotation is an admin responsibility. Rotate immediately after suspected exposure, vendor offboarding, or unclear ownership.
Next Actions
- Confirm access owners in Workspace Setup.
- Use Launch Readiness to check keys, CORS, and webhooks before launch.