Credentials and tokens

Make Agent Fast uses several credential types. They are not interchangeable. Before copying a value, identify which system issued it, which system receives it, and whether it is safe to expose in a browser.

Credential map#

Choose the right authorization method#

Use a Make Agent Fast API key for a server you control and a single Make Agent Fast account. Choose only the scopes that server needs.

Use OAuth Authorization Code with PKCE when your product connects accounts belonging to other Make Agent Fast users. OAuth applications require review before production authorization succeeds.

Use an AI-provider key only when you want Make Agent Fast to call that AI provider against your provider account. A provider key does not authorize the Make Agent Fast public API.

Use connector credentials only in the matching connector form or connector API request. A Telegram bot token cannot authorize Discord, Meta, or Make Agent Fast API requests.

Store secrets safely#

For local development, place secrets in an ignored environment file or your shell environment:

export MAF_API_KEY="maf_live_..."

For deployment, use the hosting provider's encrypted secret manager. Do not put secrets in:

• Git commits, issue descriptions, screenshots, analytics properties, or support messages.
• NEXT_PUBLIC_*, VITE_*, or other variables bundled into browser JavaScript.
• Webflow, Framer, Wix, Shopify Liquid, WordPress HTML, or a mobile-web bundle.
• Query strings. URLs are commonly retained in browser history, proxies, and logs.

Make API calls through your authenticated backend. The browser should call your backend, and your backend should attach the secret.

const response = await fetch("https://makeagent.fast/api/v1/sites", {
  headers: { Authorization: `Bearer ${process.env.MAF_API_KEY}` },
});

One-time secret rules#

API keys, webhook signing secrets, and newly issued OAuth refresh tokens must be copied when shown. The full plaintext value cannot be recovered later. If it is lost, create a replacement rather than asking support to reveal it.

AI-provider and connector credentials are encrypted before storage and are not returned through list APIs. The dashboard may show a label, prefix, last four characters, validation state, or last-used time so you can identify a credential without exposing it.

Rotation checklist#

1. Create the replacement with the same minimum scopes or provider permissions.
2. Update one deployment or receiver at a time.
3. Verify a real request succeeds and record its x-request-id.
4. Revoke the old credential.
5. Confirm old requests fail with 401 invalid_api_key or the provider's equivalent.

For OAuth, store the new refresh token returned by every refresh response before discarding the previous token. For webhook-secret rotation, run old and new endpoints in parallel until every producer and receiver uses the replacement.

If a secret is exposed#

Revoke or rotate it immediately. Removing it from the latest Git commit is not sufficient because it may remain in history, caches, logs, or forks. Review activity at both Make Agent Fast and the issuing provider, then replace any credential that shared the same storage location or deployment environment.

Continue with Authentication, Scopes and errors, or AI provider keys.