Keys & secrets

Follow Call workflows with API keys to create a credential, grant its group access to the target workflow, configure a server-side caller, and verify both authorized and rejected requests. Creating a key or saving it as a secret does not automatically grant workflow access.

Rumata provides built-in API key and secret management, allowing you to organize, store, and manage the credentials your applications, workflows, and services need.

Instead of storing API keys in your code or sharing them through chat, you can keep them in Rumata's centralized credential manager and access them at the project or factory level.

Your secrets stay hidden from AI. Rumata's AI agent can work with the names and references of your stored credentials, but it cannot read their actual values. This allows you to build AI-powered applications and integrations without sharing sensitive credentials directly with the AI model.

Open your factory workspace and navigate to System Explorer → Keys & secrets.

You'll find two main tabs:

• API keys: Create and manage credentials used to access Rumata resources.
• Secrets: Securely store sensitive values, such as third-party API keys, tokens, and other credentials used by your applications and workflows.

Both are managed from your Rumata workspace, so you can organize credentials without maintaining them separately in code or chat conversations.

Although both help manage credentials, they serve different purposes.

API keys

API keys created in Rumata allow authorized applications, backend services, and workflows to access Rumata resources.

You can control their expiration, review their status, and manage their access through resource permissions.

Secrets

Secrets are encrypted, write-only values used to store sensitive information.

For example, you might store:

• A Stripe API key for a payment integration.
• A Slack authentication token for sending notifications.
• An API key for an external AI provider.
• Credentials for a third-party service your application uses.

These values can be referenced by authorized workflows and services without exposing the credentials to the AI agent.

The important difference: The AI agent can identify a secret by its name or reference, but it cannot retrieve the stored credential value.

You can create API keys to give authorized applications and services access to Rumata resources.

Create a new API key

1. Go to System Explorer → Keys & secrets.
2. Open the API keys tab.
3. Click Create API key.
4. Enter a descriptive Name that is unique within your project.
5. Choose an expiration period: 7 days, 30 days, 90 days, 365 days, Custom, or Never expires.
6. Review the expiration date and group-access information.
7. Click Create and save credential to create the key.

Rumata automatically saves the new credential in Secrets and adds it to the default factory API-key group with its supported storage and published-workflow access.

Custom groups need appropriate grants on the target resource. A key does not publish a draft or authorize unrelated resources; keep its value server-side and check application-user ownership separately.

Manage existing API keys

Use Search API keys and the status filters to find and review credentials.

API keys may display the following statuses:

• Active: The key is valid and available for authorized requests.
• Expiring soon: The key is approaching its expiration date.
• Expired: The key can no longer authorize requests.
• Revoked: The key has been disabled and cannot be used.

You can also select Add existing key to attach a credential already available within the project.

The Secrets tab acts as your centralized credential manager.

Instead of placing sensitive values directly in source code, workflow configurations, or AI conversations, you can store them securely in Rumata.

Add a new secret

1. Open System Explorer → Keys & secrets.
2. Select the Secrets tab.
3. Click Add Secret.
4. Enter a descriptive Name, select the appropriate Type, and add a Description.
5. Enter the sensitive credential in the Value field.
6. Click Add Secret to save it.

Once saved, Rumata stores the value in encrypted, write-only storage.

Find secrets by project or factory

You can manage credentials centrally while identifying which secrets are associated with your current project or factory.

1. Open the Secrets tab.
2. Use Search secrets to find a credential by name.
3. Review the available secrets associated with your project.
4. Enable Only this factory to narrow the list to secrets associated with the current factory.
5. Select the relevant secret to review its available information and references.

This makes it easier to organize credentials across applications without repeatedly entering the same sensitive information.

One of Rumata's key security features is the separation between your stored credentials and the AI agent.

You can ask Rumata to build integrations that require sensitive credentials without providing those credentials directly in your conversation.

How it works

1. Store your API key or credential in Keys & secrets → Secrets.
2. Give the secret a recognizable name, such as `STRIPE_API_KEY`.
3. In the AI Chat, describe the integration you want to build.
4. Refer to the stored secret by its name instead of pasting its value.
5. Rumata's AI agent can use the secret reference when configuring supported workflows or services, subject to their permissions.
6. The authorized execution environment uses the credential when the integration runs, without exposing its value to the AI model.

Example

Imagine you want your application to send Slack notifications.

First, store your Slack token in Rumata's Secrets manager under the name `SLACK_BOT_TOKEN`.

Then, ask the AI agent:

The agent can configure the workflow using the secret's reference without needing to know the actual token.

Your AI agent works with the name. Your application uses the credential.

Rumata lets you manage which authorized resources can use your credentials.

This helps you control access at the project and factory level without exposing sensitive values.

Review access permissions

1. Open Keys & secrets and find the relevant credential.
2. Review its associated project, factory, or resource group information.
3. Check which groups have permission to access the credential.
4. Grant or adjust access only when needed for an intended workflow or service.
5. Test the integration to confirm it can access the required resource.

If an integration stops working, you can review its credentials without exposing their values.

Troubleshoot credential issues

1. Open Keys & secrets.
2. Find the relevant API key or secret.
3. For Rumata API keys, verify that the key is active and hasn't expired or been revoked.
4. Review the resource group's permissions and the integration's credential reference.
5. Check the corresponding workflow run or service logs for the reported error.
6. Correct the issue and test the integration again.

Keep credentials secure

Follow these practices when managing API keys and secrets:

• Store credentials in Secrets, not directly in AI Chat or source code.
• Use descriptive names so you can identify their purpose without exposing their values.
• Give workflows and services only the access they require.
• Review expiration dates for API keys.
• Replace credentials when they are compromised or no longer needed.
• Check dependent integrations before replacing or revoking an existing credential.

Check your result

Your credentials should be securely stored, visible through their names and available metadata, and accessible only to the authorized resources that need them.

With Rumata, you don't need to scatter API keys across code files, workflow configurations, or multiple development tools.

You can store and manage credentials centrally, organize them by project and factory, and use them across your authorized application components.

Most importantly, you can build with AI without handing your secret values to the AI agent.

Rumata separates credential management from AI-generated development, giving you both flexibility and control over how your applications connect to external services.