Secrets and API keys

Connecting an outside service (a payment provider, an email service, an AI model, an SMS gateway) usually means handing over an API key. Willo has one safe way to receive it, and it never involves pasting the key into chat.

The secure form

When a feature needs a key, Willo shows a secure form in the conversation, naming the key, what it's for and, where it knows, a link to the page where the service issues it. You paste the key into that form and save.

The value goes straight to Willo's platform, encrypted, and from there to your backend's secret store. It never appears in the chat, and Willo itself never sees it: the next message just says the key was set.

Keys are write-only. Nobody, Willo included, can read one back. To change a key, set a new value through the same form. Willo can tell you which keys are set, by name, and can give an editor or owner a fingerprint of each so you can check which one is in place without revealing it.

Why not paste it in chat?

A chat is kept for good, every teammate on the business can read it, and its text is sent to the AI model on every later turn. A key pasted there is effectively published. If you paste one by mistake, Willo won't use it: it asks you to rotate the key at the service (cancel it and issue a new one), then set the new one through the form.

Keys Willo creates for you

Some secrets aren't issued by an outside service at all. For example, a password your own function checks, or a signing secret for a webhook where you get to choose the value. For these, the form can generate a strong random value for you. You reveal it, copy it into the other service's settings, and save. It is never shown in chat.

Test keys for your draft

While drafting, your draft backend uses the same keys as live, so a drafted function could charge a card or send an email for real. To avoid that, set a draft-only value under the same name, for example your payment provider's test key. It is used only on the draft, never copied to live by Publish, and kept for the next time you draft. Ask Willo: "use my Stripe test key on the draft".

Where keys are used

Keys are available only to your backend functions. Your site's pages never hold them, because anything in a page is visible to every visitor. If a feature needs a key, Willo puts that part in a function.

A key written into a function's code is refused at deploy. A key in SQL is flagged in red on the approval card, and a connected AI agent can't write one into your site's files. The form is the only right place for a key.

What Willo will never take

Some things don't go through the form either, because they hand over far more than one integration:

Passwords of any kind: your site's admin password, an account password, a database password.
Account-wide tokens, such as a personal access token for a hosting or code account.
Bank details, card numbers and government ID numbers, even when they belong on a public page such as an invoice. Willo puts a placeholder there for you to fill in from the dashboard.

If a task seems to need one of these, Willo says so and offers the supported route instead.