# Add the API key an Action needs

> Choose how an Action signs in to its API, and add the key, which is stored encrypted and never shown to the AI.

Source: https://www.chirpbuilder.com/help/actions/api-key  
Plans: Essentials, Creator, Business, Academy  
Last checked: 2026-10-27

When you're done, the Action can sign in to its API.

**Who can do this:** choosing how the key is sent: the account owner, workspace admins and editors.
Adding the key itself: the account owner and workspace admins (workspace admins are on the Business
plan). Editors see "The account owner or a workspace admin adds the key."

## Choose how it signs in

1. In **7. Actions**, open the Action. Under **Authentication** (1), choose:
   - **None:** the API needs no key.
   - **API key**, then how it's **Sent as**: **Bearer token**, **Basic (user:password)**, a **Custom
     header** (type its name, like X-API-Key), or **In the web address** (type the parameter name, like
     api_key).
2. Click **Save authentication**. Visitors get the change once you click **Publish changes**.

When the schema lists the sign-in it uses (under security), this is filled in for you.

![The Plant shop Action opened: Authentication set to API key, sent in a custom X-API-Key header (1), and the key box saying it's connected, ending in 7Q4D, with a box to paste a new key (2).](https://mjmtbasmrtksluvlnema.supabase.co/storage/v1/object/public/help-media/web-optimized/actions/api-key/SS-ACT-030-01__api-key__essentials__desktop__v01.webp?v=0a18b154fd)

## Add the key

1. Paste the key in **API key** (2). For Basic, paste user:password.
2. Click **Save key**. "Key saved. It's stored encrypted."

The box then says "Connected, ending in ••••" and the key's last four characters. For Basic it just says
"Connected.", because the last four characters would be part of the password. A new key applies right
away, also for visitors once the Action is published. To change it, paste a new one. **Remove key**
removes it straight away, and visitors' calls stop working at once (there's no undo).

## How the key is kept

- Encrypted, and never shown again, even to you.
- Never sent to the AI. If an API sends the key back in a response, it's replaced with [hidden].
- Never included in exports, and not copied to another account when a workspace is handed over.

Until a key is added, the Action shows **Needs an API key** and the Chirp can't use it.

**In the web address** works, but the API's own logs may record the key there. Use a header if the API
offers one.

## Each visitor signs in (OAuth)

Signing each visitor in to their own account at the service (OAuth) is coming soon. Until then, use an
API key or no sign-in. A schema that uses OAuth is added without sign-in, with a note saying so.

## If it doesn't work

- **The Action shows "Calls are failing" and "The API refused the sign-in for recent calls."** The key
  is wrong, expired or sent the wrong way. Check it with the API's provider, then test an operation:
  see [Test an Action](https://www.chirpbuilder.com/help/actions/test).
- **"Paste the API key first."**, **"That key is too long."** or **"The key can't contain line breaks."**
- **"This Action doesn't use an API key. Choose API key under Authentication first."**
- **"Only the account owner or a workspace admin can do this."**