Store your app’s private credentials in Atoms Cloud → Keys to keep their values out of Chat and source code, and to manage separate Test and Production values.

Before using Keys, connect the project to Atoms Cloud. If it is not connected, ask the Agent to connect Atoms Cloud or follow Atoms Cloud.

Use a key in Atoms Cloud

Before you start

Before adding a key, make sure:

• You are using Atoms on desktop web.
• The project is connected to Atoms Cloud.
• You are a workspace owner. Only workspace owners can add new keys.

If Keys or New Key is unavailable, confirm that you opened the intended project and that it is connected to Atoms Cloud. If New Key remains unavailable, confirm that you are a workspace owner. If Atoms shows a plan or usage availability message, follow the on-screen availability or upgrade path, then try again.

Add a Test key

1. Open the project on a desktop device.
2. In the same workspace toolbar where the App Viewer is, select Atoms Cloud.
3. Select Keys in the Atoms Cloud sidebar.
4. Open Test Keys, then select In This Project.
5. Select New Key.
6. Complete the required fields:
   • Name: Enter a clear reference name, such as RESEND_API_KEY. Use letters, numbers and underscores, and begin with a letter or underscore.
   • Value: Enter the credential exactly as supplied by the provider.
   • Description: Explain what the key is for, such as Used to send account emails. Do not include the credential value.
7. If you want to reuse the key in other projects, select Save to Library.
8. Select Add. When the key has been saved, Atoms shows Key added successfully.

Add a Test key

Only workspace owners can add new keys. If you need a key added, ask a workspace owner.

Use a saved key in Chat

Reference the saved key instead of entering its value in a message.

1. Open the project Chat in the desktop version of Atoms and type #.
2. Select Keys.
3. Search for the saved key, then select its name.
4. Tell the Agent what the key is for and what you want the integration to do.

The # menu adds a reference to the saved key without inserting its value into your message.

Reference a saved key in Chat

Test a saved key

1. In the App Viewer, perform a simple action that uses the key.
2. Confirm that it produces the expected result, such as delivering a test email or returning test data.
3. Review any visible errors or logs and make sure they do not expose the key’s value.

If the service gives you separate test and live keys, use the test key while building your app. Use the live key only after your app is published. If the test fails, check the provider’s dashboard to confirm that the key is active and has permission to perform the requested action. Never paste the key’s value into Chat when troubleshooting.

Understand how Keys work

Before adding keys, it is helpful to understand what Atoms stores and how to protect your credentials.

What Atoms stores

Atoms Cloud → Keys stores credentials that your app uses to connect to external services, such as API keys and access tokens.

Each saved key has a name, description, and private value. The name and description help the Agent understand when to use the key, while the private value remains hidden from Chat.

Where to get a key

Atoms does not create or provide credentials for external services. You must obtain them from the relevant service provider. Follow the provider’s instructions when choosing permissions, testing the key, and checking whether it expires.

Keep private credentials secret

Never paste a private credential into Chat, source code, code that runs in the browser, screenshots, logs, or support messages. Save it in Keys, then reference the saved entry by name.

If a private value has already been exposed, treat it as compromised and revoke or rotate it through the provider.

Private and browser-safe credentials

Keys does not label saved values as Public or Private. Saving a value in Keys does not automatically make it safe to use in browser-facing code. If your app uses the value in the browser, visitors may be able to inspect it.

Check the provider’s documentation before deciding where to use a credential:

• Use a value in browser-facing code only when the provider explicitly states that it is safe to expose.
• Keep private credentials in server-side or backend logic, where they are not exposed to app visitors.

Choose the key’s environment and storage

When adding a key, you need to make two separate decisions:

• Which environment will use the key.
• Whether the key will remain in this project or be available to other projects.

Choose an environment

Option	When it is used
Test Keys	Used while developing and testing your app in the App Viewer. If you do not add a separate Production value, the published app will also use the Test value.
Production Keys	Used by the published app when it requires a separate live credential. Production values are added during the publishing process and managed separately from Test values.

Choose where to save the key

Option	When to use it
In This Project	Choose this for a key that should be used only by the current project.
Key Library	Choose this when you intentionally want to reuse a key across multiple projects. When adding or updating a Test key, select Save to Library to make it available in the library.

The environment and storage location are independent. Saving a Test key to the Key Library makes it reusable, but it does not turn it into a Production value.

Use In This Project by default. Save a key to the library only when you are certain that it should be shared across projects.

Use a separate Production value

When you publish a project that uses a saved key, the publishing flow may ask you to configure Production Keys. By default, the published app uses the Test value. To use a different credential, select Production and save a separate value for the key.

Use a separate Production value when:

• The provider supplies different test and live credentials.
• You do not want the credential used during development to be used by the published app.

Production values are created through the publishing flow. You cannot create one by selecting New Key from the Production Keys tab. After a Production value has been configured for a published app, you can view it under Atoms Cloud → Keys → Production Keys.

After publishing or updating the app, repeat the relevant user journey on the published website to confirm that the Production key works correctly. For the complete deployment process, see Publish and deploy.

Update or rotate a credential

Update a saved Test value

1. Open Atoms Cloud → Keys → Test Keys.
2. Open In This Project or Key Library, depending on where the entry was saved.
3. Select the key's Value or Description, enter the updated information, then select Update.
4. Wait for Save success, then test the affected flow again.

Planned key rotation

Follow these steps when the existing credential is still secure and you want to replace it without interrupting your app:

1. Create a replacement credential through the service provider.
2. Replace the Test value in Atoms, then test the affected feature in the App Viewer.
3. If the published app uses a separate Production value, replace it and publish the update.
4. Test the same feature on the published website.
5. After confirming that the replacement works correctly, revoke the old credential through the provider.

If a credential might have been exposed

Treat the credential as compromised and act immediately:

1. Revoke or disable it through the service provider.
2. Create a replacement credential.
3. Update the relevant Test and Production values in Atoms.
4. Test the affected features again in both the App Viewer and the published app.
5. Remove any exposed copies from source code, Chat, screenshots, and logs where possible.

Deleting a key or removing its value from Atoms does not revoke the original credential. You must revoke it through the service provider.

Remove a credential

Before deleting a saved key, make sure your app no longer depends on it:

1. Remove the feature that uses the key, or replace its references with another saved key.
2. Revoke the original credential through the service provider so that it can no longer be used.
3. Open Atoms Cloud → Keys, find the inactive entry, select Delete, and confirm.

Deleting a key cannot be undone. It may also break previews or older checkpoints that still reference it. If Delete is unavailable, the key is still marked as active. Remove or replace every reference to it before trying again.

FAQ

My Test key works in App Viewer but not after publishing. Why?

If your Test key works in App Viewer but the published app fails because a key is missing or empty:

1. Check whether the relevant Test or Production value was saved before or after the last publish. If it was saved afterward, publish again for the change to take effect.
2. Verify that the saved key has the correct Test or Production value. The published app uses the Test value unless a separate Production value is configured.
3. Review downstream-service errors for clues. “Unauthorized” commonly indicates an empty or incorrect key for that environment.

If the issue persists, contact Support and include:

• Project link or live URL
• The affected key name and whether the Test or Production value has the problem
• The full error from the downstream service
• A sanitized screenshot of the configuration page
• Whether the key configuration was saved before or after publishing

Important: Only provide key names. Do NOT send secret values, passwords, or tokens.