Credentials and security

Credentials can be stored as Anthropic or OpenAI API keys, HTTP bearer tokens, or custom HTTP header values. Today, agent nodes use Anthropic credentials to call Claude.

Secrets are encrypted at rest with Fernet and write-only: once saved, the API never returns them to the browser. Credentials belong to one account and are only readable by that account's runs.

Tokens for connected apps, the keys, passwords and OAuth secrets of your APIs, and whatever an MCP server needs to authenticate you all get the same treatment: encrypted at rest, never sent to the browser, and never placed in node config. A workflow asks the server to make the call, and the secret is added there. OAuth tokens refresh on the server before they expire.

Runs store every node's resolved input so you can debug them, but known secret values are redacted before anything is written. Responses from your APIs are scrubbed too, so an API that echoes its auth header back shows *** in the run instead of the key.

HTTP Request and API nodes refuse private, loopback and link-local addresses, and non-HTTP schemes, so a workflow cannot be used to probe the network it runs in. A custom API's path can never leave its base URL's host, and redirects are not followed.

Templates and expressions run in a sandboxed Jinja environment with strict undefined values, so a template cannot reach Python internals, and a misspelled field fails loudly instead of rendering empty.

Accounts are managed by Supabase Auth. The API verifies each request's access token against the project's public signing keys. See the Privacy Policy for what is stored.