Credentials and connections
How Appfully handles access to your services, and how to keep secrets out of your code.
How Appfully connects to services
Connections use the service's own sign-in (OAuth). Appfully receives a scoped access token, encrypts it, and keeps it on the server. It's never sent to your browser or included in your project's code.
Never put secrets in prompts or code
Your project's code runs in the browser or on the phone, where anyone using it can read it. That makes it the wrong place for:
- API keys and secret tokens
- passwords or private credentials
- personal data you don't want to share
If you publish a project, its code is visible to anyone who opens it. See What's public and what's private.
If you need a secret-backed service
After exporting, put the secret on a server you control (for example a serverless function on your host) and have your app call that server. Ready-to-use services that Appfully connects for you are planned (see Services and APIs).
If you've exposed a key
Revoke or rotate it in that provider's dashboard right away, then remove it from your project and republish.