How your keys are kept safe

When you're done, you know how Chirp Builder keeps your keys, who can see them, and what to do if one leaks.

Who this is for: account owners on any plan, and workspace admins, who add keys in the workspaces they run.

How keys are stored

These are stored encrypted (AES-256):

• your OpenRouter key, and a workspace's own OpenRouter key
• Actions' API keys
• your email services' keys and sign-ins
• the signing secrets of lead webhooks and event webhooks

Once saved, a key is never shown again, not even to you. You see at most its last four characters, like "Key ending in …" or "Connected, ending in ••••…". For an Action that signs in with Basic (user:password), it only says "Connected.", because the last characters would be part of the password.

A webhook's signing secret is shown once, when you add the webhook. Copy it then.

Passwords for Who can open a Chirp are stored as a one-way hash, so nobody can read them back. You can only set a new one.

Where each key goes

• Your OpenRouter key is only ever sent to OpenRouter: to get answers, look up what they cost and check your balance. It's never part of what the AI model reads, and never on your Chirps.
• An Action's key is added to the request to that service only, from Chirp Builder's server. "Keys are stored encrypted. They're never shown again, never sent to the AI, and never included in exports." If the service sends the key back in a reply, it's replaced with [hidden] before the AI sees it.
• An email service's key: "Your key is checked with …, stored encrypted and only ever sent to …", with the service's name.

Who can see or change them

• Your account's OpenRouter key: only you, in Settings. Team members never see your billing or account key.
• A workspace's own OpenRouter key: you or a team member can add one for a workspace other than your main one. The card shows "Key ending in …" and who added it. A key a team member adds is removed when they leave that workspace. See A separate OpenRouter key for a client's workspace.
• Action keys and email services: the account owner and workspace admins. Editors see "The account owner or a workspace admin adds the key."
• AI apps you connect can't set or read keys. They only see whether an Action has one. They can read your Actions' addresses, though, including webhook addresses, which work like passwords.

Exports and handing a workspace over

• Exports never include API keys, access codes or visitor data. They do include webhook addresses (Zapier, Make and the like), which work like passwords, so keep the .zip safe. See Export Chirps and import a package.
• Handing a workspace to a client (Business) doesn't move its email-service connections, its own OpenRouter key (unless the client added it and accepts it as a new workspace) or Action API keys. Webhooks go along switched off, for the client to check. See Hand a workspace over to a client.

If a key leaks

• OpenRouter key: make a new key at OpenRouter and delete the old one there. Then in Settings, click Replace, paste the new key and click Check & save.
• Action key: cancel it with the service, paste a new one in the Action's API key box and click Save key. Remove key stops the Action at once.
• Email service: cancel the key with the service and make a new one. In Settings, Email services, remove the service (the bin), connect it again with the new key, and choose its list again in your lead forms.
• Webhook signing secret: there's no way to make a new secret for an existing webhook. Remove the webhook and add it again: you get a new secret.

Good to know

• An access code isn't a secret. It's a simple shared code: everyone who can open the Chirp in the editor can read it, and a link with the code in it works for anyone. For real protection, use Who can open a Chirp.
• Never paste keys or passwords into a chat, with your Chirp, your AI app or our support form. Keys belong in the boxes made for them.
• There's no two-step sign-in yet. Use a strong password for Chirp Builder that you don't use anywhere else. Change it in Settings, Change password: see Reset or change your password.
• Give each service its own key, with only the access your Chirp needs, so you can cancel one without touching the others.

If it doesn't work

• "The saved key couldn't be read. Paste it again." Click Replace and paste your OpenRouter key again.
• "OpenRouter doesn't recognize this key. It may have been deleted or typed wrong." Make a new key at OpenRouter: see Connect your OpenRouter key.
• "Only the account owner or a workspace admin can do this." Ask one of them to add the key.