Connect Your App to Outside Services, Keys Stay Private

Overview

Your published Taskade Genesis app can reach the services you already use. Save an API key once, and the app pulls live data in and pushes actions back out to Shopify, Stripe, or any service with an API. The key itself stays hidden from visitors.

TL;DR: Store API keys and secrets inside your Taskade Genesis app, and Taskade calls the outside service on your app's behalf so the key is never exposed in the browser. A pre-publish check catches any stray secret before your app reaches the Community Gallery. One saved key powers every screen that needs it.

Save a Key Once, Use It Everywhere

Add your API key in your app's settings and it lives in a private vault. Every screen and action in the app can use it, but nobody browsing your app ever sees it.

• Store keys and secrets for the services your app depends on
• Reuse one saved key across every screen that needs it
• Update the key in one place when it rotates, and the whole app keeps working

Here is what the secrets panel looks like in your app's settings. Once saved, the value is never shown again. Only the key name appears in the list:

┌────────────────────────────────────────────────────────────────┐
│  App Settings  ›  Secrets                                      │
├────────────────────────────────────────────────────────────────┤
│  openai                                        Edit  ·  Delete │
│  stripe                                        Edit  ·  Delete │
│  shopify                                       Edit  ·  Delete │
│                                                                │
│  Add a secret                                                  │
│  Key     [ openweather             ]                           │
│  Value   [ sk-•••••••••••••••••••• ]   write-only              │
│                                  [ Save secret ]               │
│                                                                │
│  Stored encrypted · never shown again · only the key           │
│  name appears in the list, hidden from your visitors           │
└────────────────────────────────────────────────────────────────┘

This means a customer dashboard can show live Stripe payments, an order tool can read and write Shopify, and a support app can post to any service with an API. You hold the key. Your visitors never do.

Let Your App Call the Service for You

When a screen needs live data, Taskade makes the request to the outside service from the safe side, using your saved key. The browser only ever sees the result, never the secret.

The result: a real working app that talks to the outside world, with nothing private slipping into the page a visitor can read.

Ship It Without the Leak

Taskade Genesis reads your app before it goes live. Leave a key written directly in the app and it stops you, points to the safe spot to store it, and lets you publish once nothing private is exposed.

1. Build your app and add the keys it needs in settings.
2. Click Publish.
3. If a key is sitting in the open, Taskade flags it and shows you where to move it.
4. Store the key safely, then publish with confidence.

This check runs every time, so a stray secret never reaches the Community Gallery or your live custom domain.

What Stays Private vs. What Ships

Keys go in the vault. Only the results show up on screen. That split is what lets you connect to a payment or store service and still share the app publicly.

Common Patterns

For a deeper, zero-setup way to give your agents external tools, MCP connectors are fully managed and need no keys at all. Saved keys are the right choice when you are calling a specific service's own API directly.

Related guides

• MCP Connectors — Give agents external tools with zero setup
• Custom Domains — Put your connected app on your own branded address
• Publish Your App — Share a finished app with the world
• Community Gallery — Browse and clone connected apps by category
• App Context — Help Taskade Genesis understand what your app should do