Keys and connections — Impromptune

Which is which

Name	What it is	Whose
house key	Our own model-provider account, spent on your behalf on a paid tier.	ours
endpoint	Your own model-provider account — Bedrock, Anthropic, OpenAI, or any OpenAI-compatible server. Models from your endpoints appear in every dropdown and are used in preference to ours.	yours
step key	A secret you paste so an external step can call a service.	yours
connection	An OAuth grant letting a step act on your own account somewhere else.	yours
app credentials	The client id and secret identifying Impromptune to a provider, so a Connect button can exist at all.	ours
API key	A key your caller sends to us to reach a served version.	yours

The rule that decides where a new secret goes: a credential identifying the platform belongs in the platform's configuration; a credential belonging to a person belongs in a table, encrypted, scoped to that person. App credentials are the platform's even when a founder created them in their own developer account.

How they are stored

Encrypted at rest: endpoints, step keys and connection tokens. They are scoped to your account and never returned by any listing endpoint — you can see that a secret exists and revoke it, not read it back.
Hashed, not stored: API keys. We keep a SHA-256 and show you the key exactly once. Lose it and you make another.
Refreshed for you: OAuth access tokens, a minute before they expire, on the path that uses them. A token that expires mid-request is the failure that machinery exists to prevent.

Everything of yours is revocable from Endpoints & keys in the studio. Revoking a step key leaves the step wired but unauthorised, which is deliberate: you get an error naming the step, not a program that silently stopped using it.

Connections, specifically

A connection is made on the provider's own consent screen — you are never asked to paste an admin token into us to make one. You can revoke it from the provider's side as well as ours, and we record the scopes it actually granted rather than the ones we requested, so a step needing permission you did not give says so instead of failing at row one.

You may hold more than one connection to the same provider. If you do, each step asks which account to use — useful when the data lives in one portal and your sandbox is another.

A connection is read access to a real system. Whatever a step fetches gets frozen onto your dataset and recorded on your traces. Point it at a sandbox while you are building, and at production when you mean it.