Connections and secrets

Most automations talk to another service. ClickRuntime gives them access in one of four ways.

Email to you: no setup#

Email is a built-in connection that is always connected. Scripts can email the automation owner's verified address directly, up to 10 emails per run and 200 per workspace per day. Ask for "email me" and nothing else is needed.

Slack for notifications#

ClickRuntime's own Slack app posts run alerts and notify.slack messages to your Slack workspace. Connect it once under Slack for notifications on Connections & secrets, then invite the ClickRuntime app to each channel it should post in. Scripts never receive this connection's token.

Ready-made apps#

For some services, ClickRuntime has already registered an OAuth app. When one covers what an automation needs, your assistant uses it and you only sign in and approve on the provider's consent screen. There is nothing to register and no client ID or secret to enter.

Each ready-made app asks for a fixed set of permissions, and some have limits, such as working only with files you pick when you connect. A service can have more than one ready-made app with different permissions. When none fits an automation, your assistant helps you add your own app instead, as described below. The choice is made per automation, so one automation can use a ready-made app while another uses your own.

Accounts connected through a ready-made app appear under Connections on Connections & secrets, where you can reconnect or disconnect them like any other account.

Your apps: connections to any service#

When a script needs to act inside another account (read a Google Sheet, post as your own Slack bot, update HubSpot) and no ready-made app fits, it uses an OAuth app you register with that service. Any service that supports OAuth works. ClickRuntime stores the resulting tokens encrypted, refreshes them when needed, and gives them to the script only while it runs.

1. Create an app in the provider's developer console, for example api.slack.com/apps or Google Cloud Console. Your assistant can draft the settings for you, including the redirect URL to paste.
2. On Connections & secrets, under Your apps, select Add an app and enter the client ID and client secret. The client secret is encrypted and never shown again.
3. Select Connect and approve on the provider's consent screen. One app can connect several named accounts, such as work and personal.

Automations get exactly the access you gave that app. For Slack, they post to and read only the channels you invite your app to. If access is revoked or expires, the account shows Reconnect.

When the assistant needs a connection, it shows a Connect button that opens the provider's consent screen. If the app isn't added yet, it walks you through adding it first. To remove access, select Disconnect; automations that rely on it show Needs setup.

Only workspace owners and admins can add apps and connect accounts.

Secrets#

A secret is an API key or token for any other service, such as Stripe, OpenAI, Twilio or your own API. Secrets have names like STRIPE_API_KEY, and the script asks for each one by name while it runs, with credentials.secret("STRIPE_API_KEY"). Secrets are never placed in the script's environment, and a script can read only the secrets its automation declares.

Never paste a key into the chat. If you do, revoke it with the provider and create a new one. The assistant is designed never to ask for one.

To add a secret:

1. When the assistant says a secret is needed, select the link it gives you. It opens Connections & secrets in the ClickRuntime dashboard with the name filled in. You can also open that page yourself.
2. Paste the value and save.
3. The page shows the last four characters once, so you can check it's the right key. After that only the name is shown.
4. Go back to your assistant and say "I've added it". The assistant checks again. It can see that the secret exists, never its value.

To rotate a key, select Replace next to it, or save a new value under the same name. The secrets list shows which automations use each one. Deleting a secret makes the automations that use it fail until you add it again.

Only workspace owners and admins can add or delete secrets.

How secrets are protected#

• Encrypted at rest and write-only: nobody can read a value back, including you.
• Fetched by the script only while it runs, and only if the automation declares it.
• Masked in logs, results and errors, including encoded forms.
• Never sent to the AI assistant.