How to Add API Keys and Secrets in ChanTan Studio

Store a key from a service like Stripe or Resend so your app can use it safely: pasted once, encrypted, never shown in chat or in your code.

Some features need a key from an outside service — a payment provider, an email sender, a maps service. A key is like a password that lets your app talk to that company.

ChanTan keeps those in "Secrets" — "Add sensitive information like API keys that your app needs to work securely."

The easiest route is to do nothing. When a feature needs your key, the AI shows a masked "paste your key" card right under its message in the chat. The key goes straight into encrypted storage, is used only on the server, and never appears in the chat or in your code.

This page is for when you want to add or change one yourself.

1. Open "Manage ▾" → "Database"

At the top of your project, press "Manage ▾", then "Database".

2. Go to "Advanced" → "Secrets"

From "Your app's engine room", find the quieter "Advanced" row and open "Secrets".

3. Press "Add New Secret"

A form appears asking for a name and a value.

4. Type the name, paste the value

The name is a label (for example, the name the service told you to use). The value is the key itself — paste it exactly, with no extra spaces.

⚠️ Names starting with CHANTAN_ are refused. Those are reserved: "Chantan manages a few secrets for you behind the scenes so your app can use AI. They're kept safe and hidden here." You can't change or delete those, and you don't need to.

5. Press "Create Secrets"

✅ Done. Your key now appears in the list showing only its name and the date — never the value itself. That's deliberate: after saving, the value is never shown back to you, not even to you.

Replacing a key that changed

Ask in the chat — say something like "my Stripe key changed" — and a "Replace key" card appears for you to paste the new one.

Deleting a key

Deleting makes you type the word delete first, because removing a key can stop part of your app working.

⚠️ Write your keys down somewhere safe of your own. ChanTan never shows a saved value again, so if you delete one and don't have it elsewhere, you'll have to get a fresh key from the service.

Related: server code that uses your keys

Webhooks and server-side integrations (payment callbacks, for example) run as "Edge Functions" — "Small bits of server code that power things like payment webhooks and integrations. Ask the AI in chat to add one."

That screen is a read-only list — there is deliberately no "create" button. To add one, describe what you need in the chat.

Honest limits

• Your keys are never pushed to GitHub. If you use "Push to GitHub", you're told: "Your database keys were replaced with placeholders — they are never pushed to GitHub."
• Keys are used server-side only — they don't reach the browsers of people visiting your app.
• AI features inside your app need no key at all. Chatbots, image generation and image understanding work out of the box, billed to your credit wallet.
• ChanTan can't fetch a key for you. If you lost it, get a new one from the service that issued it, then paste the new one.

If something goes wrong