# API keys

> When Tamo needs an API key, it sends a private form. The key is stored encrypted, only sent to the site you gave it for, and never shown again.

Web page: https://heytamo.com/docs/keys/

Some tasks need an API key, like a token for a service's API. You never paste those into
the chat. Tamo sends you a button instead:

```chat
tamo: I need a key for api.example.com, to check your usage.

Tap below to add it. Don't send it here in the chat. Nobody can read it back, me included, and I'll only use it for api.example.com, asking you before any command of mine gets it.
buttons: 🔑 Add key
```

**🔑 Add key** opens a small form that shows the key's name, the one site it will ever be
sent to and what it's for. Paste the key and tap **Save**. The chat message then shows
✅ Saved, ❌ Cancelled or ⌛ Timed out.

## How keys are kept

- Keys are stored encrypted. Tamo can't read them back or show them to anyone, itself included.
- A key is only ever sent to the site you gave it for.
- Keys are hidden from everything Tamo reads, so one can't leak into a reply.
- Every command that uses a key asks you first, every time:

```chat
tamo: I'm about to run this in my terminal with your key EXAMPLE_TOKEN:

curl https://api.example.com/v1/usage

Allow? You gave it for api.example.com. The command can use the key however it says, so check it does what you asked.
buttons: Yes, do it | No
```

Tamo asks for a key once, and only asks again if you tell it the key changed or the site
turns it down.

## Seeing and deleting keys

Send `/secrets` to see the keys you've given Tamo: each one's name, its site, when you added
it and when it was last used, with a delete button. The
[dashboard](https://heytamo.com/docs/dashboard/) lists them too. Values are never shown again, anywhere.

---

Sign up at https://app.heytamo.com/ with your email, or message Tamo on Telegram (https://t.me/heytamo_bot), free to start. All docs: https://heytamo.com/docs.md