# How your keys are kept safe > How Chirp Builder stores your OpenRouter key, Action keys, email-service keys and webhook secrets, where each one goes, and what to do if one leaks. Source: https://www.chirpbuilder.com/help/privacy-security/keys Plans: Essentials, Creator, Business, Academy Last checked: 2026-10-27 When you're done, you know how Chirp Builder keeps your keys, who can see them, and what to do if one leaks. **Who this is for:** account owners on any plan, and [workspace admins](https://www.chirpbuilder.com/help/start-here/glossary#workspace-admin), who add keys in the [workspaces](https://www.chirpbuilder.com/help/start-here/glossary#workspace) they run. ## How keys are stored These are stored encrypted (AES-256): - your [OpenRouter](https://www.chirpbuilder.com/help/start-here/glossary#openrouter) key, and a workspace's own OpenRouter key - Actions' API keys - your email services' keys and sign-ins - the signing secrets of lead webhooks and event webhooks Once saved, a key is never shown again, not even to you. You see at most its last four characters, like "Key ending in …" or "Connected, ending in ••••…". For an Action that signs in with **Basic (user:password)**, it only says "Connected.", because the last characters would be part of the password. ![The AI provider: OpenRouter card in Maya's Settings after clicking Replace: an empty Paste your key box, the outlined note Your key is encrypted and only ever sent to OpenRouter. It's never shown again, here or on your Chirps., and the Check & save and Cancel buttons.](https://mjmtbasmrtksluvlnema.supabase.co/storage/v1/object/public/help-media/web-optimized/privacy-security/keys/SS-PRIV-015-01__openrouter-key-encrypted__essentials__detail__v01.webp?v=67acbe01ab) A webhook's signing secret is shown once, when you add the webhook. Copy it then. Passwords for [Who can open a Chirp](https://www.chirpbuilder.com/help/publishing/who-can-open) are stored as a one-way hash, so nobody can read them back. You can only set a new one. ## Where each key goes - **Your OpenRouter key** is only ever sent to OpenRouter: to get answers, look up what they cost and check your balance. It's never part of what the AI model reads, and never on your Chirps. - **An Action's key** is added to the request to that service only, from Chirp Builder's server. "Keys are stored encrypted. They're never shown again, never sent to the AI, and never included in exports." If the service sends the key back in a reply, it's replaced with [hidden] before the AI sees it. - **An email service's key:** "Your key is checked with …, stored encrypted and only ever sent to …", with the service's name. ![The Plant shop Action opened in Garden Helper's editor: Authentication set to an API key in a custom X-API-Key header, the key box saying Connected, ending in ••••7Q4D, a box to paste a new key, Save key and Remove key, and, outlined, Keys are stored encrypted. They're never shown again, never sent to the AI, and never included in exports.](https://mjmtbasmrtksluvlnema.supabase.co/storage/v1/object/public/help-media/web-optimized/privacy-security/keys/SS-PRIV-015-02__action-key-encrypted__essentials__desktop__v01.webp?v=7ddd24fead) ## Who can see or change them - **Your account's OpenRouter key:** only you, in **Settings**. Team members never see your billing or account key. - **A workspace's own OpenRouter key:** you or a team member can add one for a workspace other than your main one. The card shows "Key ending in …" and who added it. A key a team member adds is removed when they leave that workspace. See [A separate OpenRouter key for a client's workspace](https://www.chirpbuilder.com/help/business-teams/client-keys). - **Action keys and email services:** the account owner and workspace admins. Editors see "The account owner or a workspace admin adds the key." - **AI apps you connect** can't set or read keys. They only see whether an Action has one. They can read your Actions' addresses, though, including webhook addresses, which work like passwords. ## Exports and handing a workspace over - **Exports** never include API keys, access codes or visitor data. They do include webhook addresses (Zapier, Make and the like), which work like passwords, so keep the .zip safe. See [Export Chirps and import a package](https://www.chirpbuilder.com/help/chirps/export-and-import). - **Handing a workspace to a client** (Business) doesn't move its email-service connections, its own OpenRouter key (unless the client added it and accepts it as a new workspace) or Action API keys. Webhooks go along switched off, for the client to check. See [Hand a workspace over to a client](https://www.chirpbuilder.com/help/business-teams/hand-over). ## If a key leaks - **OpenRouter key:** make a new key at OpenRouter and delete the old one there. Then in **Settings**, click **Replace**, paste the new key and click **Check & save**. - **Action key:** cancel it with the service, paste a new one in the Action's **API key** box and click **Save key**. **Remove key** stops the Action at once. - **Email service:** cancel the key with the service and make a new one. In **Settings**, **Email services**, remove the service (the bin), connect it again with the new key, and choose its list again in your lead forms. - **Webhook signing secret:** there's no way to make a new secret for an existing webhook. Remove the webhook and add it again: you get a new secret. ## Good to know - **An access code isn't a secret.** It's a simple shared code: everyone who can open the Chirp in the editor can read it, and a link with the code in it works for anyone. For real protection, use [Who can open a Chirp](https://www.chirpbuilder.com/help/publishing/who-can-open). - **Never paste keys or passwords into a chat,** with your Chirp, your AI app or our support form. Keys belong in the boxes made for them. - **There's no two-step sign-in yet.** Use a strong password for Chirp Builder that you don't use anywhere else. Change it in **Settings**, **Change password**: see [Reset or change your password](https://www.chirpbuilder.com/help/account-billing/password). - **Give each service its own key,** with only the access your Chirp needs, so you can cancel one without touching the others. ## If it doesn't work - **"The saved key couldn't be read. Paste it again."** Click **Replace** and paste your OpenRouter key again. - **"OpenRouter doesn't recognize this key. It may have been deleted or typed wrong."** Make a new key at OpenRouter: see [Connect your OpenRouter key](https://www.chirpbuilder.com/help/openrouter/connect-key). - **"Only the account owner or a workspace admin can do this."** Ask one of them to add the key.