← Docs

API keys

When Tamo needs an API key, it sends a private form. The key is stored encrypted, only sent to the site you gave it for, and never shown again.

Some tasks need an API key, like a token for a service’s API. You never paste those into the chat. Tamo sends you a button instead:

Tamo: I need a key for api.example.com, to check your usage. Tap below to add it. Don't send it here in the chat. Nobody can read it back, me included, and I'll only use it for api.example.com, asking you before any command of mine gets it.
🔑 Add key

🔑 Add key opens a small form that shows the key’s name, the one site it will ever be sent to and what it’s for. Paste the key and tap Save. The chat message then shows ✅ Saved, ❌ Cancelled or ⌛ Timed out.

How keys are kept

  • Keys are stored encrypted. Tamo can’t read them back or show them to anyone, itself included.
  • A key is only ever sent to the site you gave it for.
  • Keys are hidden from everything Tamo reads, so one can’t leak into a reply.
  • Every command that uses a key asks you first, every time:
Tamo: I'm about to run this in my terminal with your key EXAMPLE_TOKEN: curl https://api.example.com/v1/usage Allow? You gave it for api.example.com. The command can use the key however it says, so check it does what you asked.
Yes, do itNo

Tamo asks for a key once, and only asks again if you tell it the key changed or the site turns it down.

Seeing and deleting keys

Send /secrets to see the keys you’ve given Tamo: each one’s name, its site, when you added it and when it was last used, with a delete button. The dashboard lists them too. Values are never shown again, anywhere.