Overview
Your published Taskade Genesis app can reach the services you already use. Save an API key once, and the app pulls live data in and pushes actions back out to Shopify, Stripe, or any service with an API. The key itself stays hidden from visitors.
TL;DR: Store API keys and secrets inside your Taskade Genesis app, and Taskade calls the outside service on your app's behalf so the key is never exposed in the browser. A pre-publish check catches any stray secret before your app reaches the Community Gallery. One saved key powers every screen that needs it.
Save a Key Once
Open your app's settings, go to Advanced → Secrets, and add the API key. It lives in a private vault from that moment on. Every screen and action in the app can use it, but nobody browsing your app ever sees it.
- Store keys and secrets for the services your app depends on
- Reuse one saved key across every screen that needs it
- Update the key in one place when it rotates, and the whole app keeps working
Here is what the secrets panel looks like in your app's settings. Once saved, the value is never shown again. Only the key name appears in the list:
┌────────────────────────────────────────────────────────────────┐
│ App Settings › Advanced › Secrets │
├────────────────────────────────────────────────────────────────┤
│ openai Edit · Delete │
│ stripe Edit · Delete │
│ shopify Edit · Delete │
│ │
│ Add a secret │
│ Key [ openweather ] │
│ Value [ sk-•••••••••••••••••••• ] write-only │
│ [ Save secret ] │
│ │
│ Stored encrypted · never shown again · only the key │
│ name appears in the list, hidden from your visitors │
└────────────────────────────────────────────────────────────────┘
A customer dashboard can show live Stripe payments. An order tool can read and write Shopify. A support app can post to any service with an API. You hold the key. Your visitors never do.
Let Your App Make the Call
When a screen needs live data, Taskade makes the request to the outside service from the safe side, using your saved key. The browser only ever sees the result, never the secret.
The result: a real working app that talks to the outside world, with nothing private slipping into the page a visitor can read.
Ship It Without the Leak
Taskade Genesis reads your app before it goes live. Leave a key written directly in the app and it stops you, points to the safe spot to store it, and lets you publish once nothing private is exposed.
- Build your app and add the keys it needs in settings.
- Click Publish.
- If a key is sitting in the open, Taskade flags it and shows you where to move it.
- Store the key safely, then publish with confidence.
This check runs every time, so a stray secret never reaches the Community Gallery or your live custom domain.
Private vs. Published
| What you save | Where it lives | Who can see it |
|---|---|---|
| API keys and secrets | Private vault inside your app | Only you |
| The live result of a call | The screen a visitor is viewing | Anyone using the app |
| Your app's pages and design | The published app | Anyone you share it with |
Keys go in the vault. Only the results show up on screen. That split is what lets you connect to a payment or store service and still share the app publicly.
Common Patterns
| You want to... | Do this |
|---|---|
| Show live orders or payments | Save the service key, then point a screen at that data |
| Let customers submit something to an outside tool | Add an action that uses your saved key |
| Swap to a new key | Update it once in settings, no rebuild needed |
| Give an agent live tool access without keys | Use the built-in agent tools, or hand the work to an automation that carries it into a connected app |
To give your agents outside reach with no setup, use the built-in tools. Taskade manages them, and they need no keys. An automation carries the work into the 100+ apps you already use, credentials included. Saved keys are the right choice for a direct call to the API of a specific service.
Related guides
- MCP Connectors. Let external AI clients like Claude Desktop or Cursor read your workspace over MCP
- Custom Domains. Put your connected app on your own branded address
- Publish Your App. Share a finished app with the world
- Community Gallery. Browse and clone connected apps by category
- App Context. Help Taskade Genesis understand what your app must do