---
title: Outside APIs and secrets
description: Call third-party APIs that need a secret key from the browser with crow.api, without the key ever reaching the page.
---

# Outside APIs and secrets

Many apps need a service that takes a secret key: Stripe, Airtable, a weather API. Putting the key in the page would hand it to everyone who opens the app, so Crow Nest keeps it on the server and adds it to each call for you.

## 1. Declare the API in crow.json

```json
{
  "apis": {
    "stripe": { "url": "https://api.stripe.com/v1/", "headers": { "authorization": "Bearer {{STRIPE_KEY}}" }, "who": "viewers" }
  }
}
```

- `url` must be `https` and end in `/`. Calls can only reach paths under it.
- `{{NAME}}` placeholders work in `headers` and `query` and are filled from the app's secrets.
- `who` is `owner`, `viewers` or `public`.

## 2. Set the secret

Ask your AI to set it. The `tool_secret` tool asks you for the value privately: it never passes through the conversation. You can also set secrets on the app's Secrets page in the dashboard. An app can have up to 20 secrets, each up to 8 KB, and values are encrypted at rest.

## 3. Call it

```js
const res = await crow.api("stripe").fetch("customers?limit=3");   // a normal fetch Response
const data = await res.json();
```

The call goes through Crow Nest, which checks who's calling, adds the secret, and forwards it. The browser never sees the key.

## From server code

Server code gets the same APIs with `env.CROW.api("stripe").fetch(...)`, and every secret on `env` by name (`env.STRIPE_KEY`). See [Server code](/server-code).

> **Warning** Never put a key in the app's files. Publishing refuses files that contain API keys or tokens.