Billing and administration
Account, credentials, secrets, and data safety
Protect Yanola access, API keys, connected accounts, function secrets, webhooks, and customer data.
AdministratorsDevelopersAutomation buildersBeginnerAvailable
What this guide covers
- Yanola separates browser account access, connected-service authorization, function secrets, webhook secrets, and Agent Project API keys.
- Prerequisites: Use a password manager and a trusted server-side secret store.
- Result: Secrets are stored only in designated controls, connections validate, and no credential appears in client code or AI prompts.
- Limit: The current account UI does not expose SSO, MFA configuration, session management, member roles, or a general audit-history browser.
What this is and when to use it
Yanola separates browser account access, connected-service authorization, function secrets, webhook secrets, and Agent Project API keys.
| Use it when | Expected outcome |
|---|---|
You connect an external service. | Secrets are stored only in designated controls, connections validate, and no credential appears in client code or AI prompts. |
You create an API key, webhook, or Function secret. | Secrets are stored only in designated controls, connections validate, and no credential appears in client code or AI prompts. |
You review account deletion. | Secrets are stored only in designated controls, connections validate, and no credential appears in client code or AI prompts. |
Before you begin
- Use a password manager and a trusted server-side secret store.
Prerequisites
Use a password manager and a trusted server-side secret store.
Complete the task
- Keep API keys and webhook signing secrets out of browser and mobile code.
- Use Integrations connect flows rather than placing provider tokens in workflow fields.
- Use Function Environment Secrets for function credentials.
- Grant only the external permissions required for intended actions.
- Reconnect expired/error connections and revoke unused ones.
- Rotate any credential exposed to logs, prompts, or source control.
Confirm it worked
- Secrets are stored only in designated controls, connections validate, and no credential appears in client code or AI prompts.
Common problems
| Symptom | What to check |
|---|---|
A secret was exposed | Revoke or rotate it immediately, update the secure store, and inspect usage. |
Connected account is expired | Reconnect through Integrations; do not paste an access token into a node. |
Current limitations
The current account UI does not expose SSO, MFA configuration, session management, member roles, or a general audit-history browser.
Product boundary
The current account UI does not expose SSO, MFA configuration, session management, member roles, or a general audit-history browser.
Where to go next
Related documentation
Authentication and API keysUnderstand Agent Project scope, Test and Live key prefixes, secure storage, rotation, and revocation.Connected services overviewConnect supported external accounts and use their cataloged actions from the workflow App Action node.Account settings and deletionUpdate your name and password, understand the fixed sign-in email, and safely delete an account.