Credentials (API keys)
A credential is an API key of a provider you already pay for, stored once in your workspace and then chosen wherever it is needed: the assistant's model, an AI tool's providers, a voice assistant, a flow's request step. One key, one row, used in many places.
- Web panel: Settings → Credentials.
- Mobile app: Menü → Workspace → Credentials.
Both appear only for people with the Manage credentials permission (administrators have it by role). Everyone else does not see them, and the key pickers show them only the names of the keys already stored.
What can be stored
| Group | Providers | Used by |
|---|---|---|
| AI providers | OpenAI, Anthropic, Google Gemini, xAI, DeepSeek, Meta (Muse) | The assistant's chat model, its fallback key, knowledge embeddings (OpenAI only), transcription; OpenAI and Gemini image models in Image Studio |
| Web search | Google Programmable Search, Brave Search, Tavily, SerpApi, SearchApi, Serper | Web search |
| Voice vendors | ElevenLabs, Deepgram, Cartesia | Voice assistants |
| Image vendors | Magnific, fal.ai | Image Studio |
| Requests (flows) | API key for a request | A flow's Request step calling your own systems |
One OpenAI key serves both chat and voice assistants — there is no separate voice entry to add.
Some providers ask for one more thing next to the key:
- OpenAI — Base URL (only for an OpenAI-compatible deployment such as Azure, a proxy or your own gateway) and Organization ID (only if your account bills to a specific organization). Both are optional.
- Google Programmable Search — Search engine ID (cx). Without it the key searches nothing.
Every other provider asks for the key alone.
The key is never shown again
A key is encrypted when it is saved and is never displayed again — not on the web, not in the app, not to administrators. The list shows only its last 4 characters so you can tell two keys of the same provider apart (Prod OpenAI ····qZ4d and Test OpenAI ····HM87).
Adding a key
- Open Credentials and choose Add credential.
- Pick the provider, give the key a name you will recognise, and paste the key.
- Fill in the provider's extra field if it has one.
- Optionally turn on Test the connection after saving, and set a rate limit (see below).
- Save.
Testing a key
Test connection asks the provider whether it accepts the key and writes the result on the row: OK, Failed (with a short reason — never a piece of the key) or Untested. A few providers have no test; for those the key is stored and used as it is.
For a voice vendor the reason says what to fix: a rejected key needs a new key, a key without the right plan or scope needs the plan changed rather than the key replaced, and a blocked network needs network access checked.
Replacing a key
Paste a new key into Replace the key (web: the edit dialog's API key field) and save. The credential keeps its name and its place everywhere it is used — the assistant, a tool chain, a voice assistant all carry on with the new key. The test result is reset to Untested; test it again to confirm.
Name, extra fields, active, rate limit
You can rename a credential, change its extra fields, and switch it Active or inactive (an inactive key is kept but never used). A rate limit caps how many calls per minute the key may drive, with an optional burst that must be at least the per-minute rate; leave both blank for no limit of your own.
Usage shows the calls in the current minute against the limit, the calls and tokens this period, how often a fallback key rescued a reply, the provider's recent 429 answers and the last failure.
Deleting a key
Deleting asks for confirmation and cannot be undone. A key that is still in use by the assistant's chat model, its fallback key, its knowledge embeddings, or a voice assistant cannot be deleted: you are told where it is used, choose another key there first, then delete this one. Anything else that still points at a deleted key (an AI tool's provider, a flow) stops using it until another key is chosen.
On the phone
Menü → Workspace → Credentials lists your keys grouped by kind, with their status, the last 4 characters and when they were last tested. Tap one to test it, replace the key, rename it, change its extra fields, switch it active, set its rate limit, see its usage, or delete it. Add a credential at the bottom adds a key of any provider above.
Where the app asks you to choose a key — AI training → Model, and each provider of an AI tool (web search, Image Studio) — there is an Add a key row. It opens the same form, limited to the providers that fit there, and brings you back with the new key already chosen; save the screen you came from to use it.
The key field is masked and has a Paste button; the app turns off autocorrect, autofill and suggestions for it. The key is sent once, to ConnectWiz, and is not kept on the phone — not in its storage, not in its cache, and it is removed from crash reports before they leave the device.