Add the API key an Action needs

When you're done, the Action can sign in to its API.

Who can do this: choosing how the key is sent: the account owner, workspace admins and editors. Adding the key itself: the account owner and workspace admins (workspace admins are on the Business plan). Editors see "The account owner or a workspace admin adds the key."

Choose how it signs in

1. In 7. Actions, open the Action. Under Authentication (1), choose:
   • None: the API needs no key.
   • API key, then how it's Sent as: Bearer token, Basic (user:password), a Custom header (type its name, like X-API-Key), or In the web address (type the parameter name, like api_key).
2. Click Save authentication. Visitors get the change once you click Publish changes.

When the schema lists the sign-in it uses (under security), this is filled in for you.

Add the key

1. Paste the key in API key (2). For Basic, paste user:password.
2. Click Save key. "Key saved. It's stored encrypted."

The box then says "Connected, ending in ••••" and the key's last four characters. A new key applies right away, also for visitors once the Action is published. To change it, paste a new one. Remove key removes it straight away, and visitors' calls stop working at once (there's no undo).

How the key is kept

• Encrypted, and never shown again, even to you.
• Never sent to the AI. If an API sends the key back in a response, it's replaced with [hidden].
• Never included in exports, and not copied to another account when a workspace is handed over.

Until a key is added, the Action shows Needs an API key and the Chirp can't use it.

In the web address works, but the API's own logs may record the key there. Use a header if the API offers one.

Each visitor signs in (OAuth)

Signing each visitor in to their own account at the service (OAuth) is coming soon. Until then, use an API key or no sign-in. A schema that uses OAuth is added without sign-in, with a note saying so.

If it doesn't work

• The Action shows "Calls are failing" and "The API refused the sign-in for recent calls." The key is wrong, expired or sent the wrong way. Check it with the API's provider, then test an operation: see Test an Action.
• "Paste the API key first.", "That key is too long." or "The key can't contain line breaks."
• "This Action doesn't use an API key. Choose API key under Authentication first."
• "Only the account owner or a workspace admin can do this."