Build apps

Outside APIs and secrets

Many apps need a service that takes a secret key: Stripe, Airtable, a weather API. Putting the key in the page would hand it to everyone who opens the app, so Crow Nest keeps it on the server and adds it to each call for you.

#1. Declare the API in crow.json

{
  "apis": {
    "stripe": { "url": "https://api.stripe.com/v1/", "headers": { "authorization": "Bearer {{STRIPE_KEY}}" }, "who": "viewers" }
  }
}

• url must be https and end in /. Calls can only reach paths under it.
• {{NAME}} placeholders work in headers and query and are filled from the app's secrets.
• who is owner, viewers or public.

#2. Set the secret

Ask your AI to set it. The tool_secret tool asks you for the value privately: it never passes through the conversation. You can also set secrets on the app's Secrets page in the dashboard. An app can have up to 20 secrets, each up to 8 KB, and values are encrypted at rest.

#3. Call it

const res = await crow.api("stripe").fetch("customers?limit=3");   // a normal fetch Response
const data = await res.json();

The call goes through Crow Nest, which checks who's calling, adds the secret, and forwards it. The browser never sees the key.

#From server code

Server code gets the same APIs with env.CROW.api("stripe").fetch(...), and every secret on env by name (env.STRIPE_KEY). See Server code.