API Key Storage

Not every integration uses OAuth. Many APIs authenticate with static API keys or webhook secrets. Authpipe stores these with the same encryption and retrieval model as OAuth tokens.

Store a credential

Use storeCredential to save an API key or webhook secret. This creates a connection with credential_type set to "api_key" or "webhook_secret".

Node

const result = await authpipe.storeCredential({
  provider: "sendgrid",
  tenantId: "org_acme",
  credentialType: "api_key",
  credential: "SG.xxxx.yyyy",
});

console.log(result.connection_id); // "conn_..."
console.log(result.status);        // "active"

Go

result, err := client.StoreCredential(ctx, &authpipe.StoreCredentialParams{
  Provider:       "sendgrid",
  TenantID:       "org_acme",
  CredentialType: "api_key",
  Credential:     "SG.xxxx.yyyy",
})

Python

result = client.store_credential(
    provider="sendgrid",
    tenant_id="org_acme",
    credential_type="api_key",
    credential="SG.xxxx.yyyy",
)

Parameters

Parameter	Required	Description
provider	Yes	Provider slug
tenant_id	Yes	Tenant that owns this credential
credential_type	Yes	"api_key" or "webhook_secret"
credential	Yes	The secret value to store
user_id	No	For user-attached credentials
installation_id	No	Link to an existing installation

Retrieve a credential

Use the same getCredential call as OAuth tokens. The response includes credential_type so you know what you’re getting.

Node

const { credential, credential_type } = await authpipe.getCredential({
  provider: "sendgrid",
  tenantId: "org_acme",
});

// credential_type === "api_key"
// credential === "SG.xxxx.yyyy"

Go

result, err := client.GetCredential(ctx, &authpipe.GetCredentialParams{
  Provider: "sendgrid",
  TenantID: "org_acme",
})
// result.CredentialType == "api_key"

Python

result = client.get_credential(
    provider="sendgrid",
    tenant_id="org_acme",
)
# result.credential_type == "api_key"

Rotating credentials

To rotate an API key, call storeCredential again with the same provider and tenant. Authpipe upserts the connection with the new value and emits a credential.rotated event.

Node

await authpipe.storeCredential({
  provider: "sendgrid",
  tenantId: "org_acme",
  credentialType: "api_key",
  credential: "SG.new-key.zzzz",
});

Go

_, err := client.StoreCredential(ctx, &authpipe.StoreCredentialParams{
  Provider:       "sendgrid",
  TenantID:       "org_acme",
  CredentialType: "api_key",
  Credential:     "SG.new-key.zzzz",
})

Python

client.store_credential(
    provider="sendgrid",
    tenant_id="org_acme",
    credential_type="api_key",
    credential="SG.new-key.zzzz",
)

Storing webhook secrets

Webhook secrets from providers (e.g., Stripe’s whsec_...) are stored the same way:

await authpipe.storeCredential({
  provider: "stripe",
  tenantId: "org_acme",
  credentialType: "webhook_secret",
  credential: "whsec_abc123",
});

Retrieve it when you need to verify inbound webhooks:

const { credential } = await authpipe.getCredential({
  provider: "stripe",
  tenantId: "org_acme",
});

Provider config requirement

You still need a provider config for the provider, even for API key storage. Create one with auth_api_key support and set attachment to control tenant vs. user scoping.