Hatchik help → Keys, passwords and other settings

Keys, passwords and other settings

Most apps need one thing they cannot make up for themselves: a key. Taking a card payment needs a key from the payment company. Sending an email needs one from the email company. Letting people sign in with Google needs one from Google. It is a long string of letters and numbers that proves your app is allowed to use that service, and it is the nearest thing your business has to a house key.

You do not need to understand any of that. You need to know three things.

1. Never paste a key into the chat

Not to Claude, not to anyone. Once a key is in a conversation it is in the record of that conversation, and that record does not go away when you close the window. Anyone who ever sees it can spend your money, read your customers' details or send email as you, and nothing about deleting the message takes it back.

So Hatchik does not accept keys in chat, and Claude is told to refuse them. Say what you are trying to do — "I want to take payments" — and you will get a private link instead.

2. The link

Claude sends you a link. You open it, and it asks for exactly the keys your app needs, each with a line saying what it is and where to find it. You paste them in and press save.

The link works once and lasts an hour. Ask for another any time.
You do not sign in to use it. The link itself is the permission, and all it can do is put those named keys into that one site — it cannot read anything.
What you type is stored scrambled, and it is never shown again. Not to you, not to Claude, not on your project page, not in your download. Claude is told it worked, and nothing else.
Some keys are ones nobody has to fetch — the long random string an app uses to keep people signed in, for instance. Hatchik invents those itself, so there is no link and nothing for you to do.

3. Your draft and your live site keep separate keys

This is the part nobody expects, and it is worth knowing, because it is what lets you build safely.

Every project has a locked draft, which you open from your project page and nobody else can, and a live site that the public sees. They keep their own separate settings. Payment companies give you two sets of keys — test ones, which pretend to take money, and real ones, which actually do. So:

Put the test keys on your draft. Buy your own product with a pretend card. Check the confirmation email arrives, the order shows up, the whole thing works.
Put the real keys on the live site, when you are ready to open.

The same app behaves correctly in both places, because it just reads whichever key it was given. You never have to change the app to go live.

Publishing does not carry keys across. When you make your draft live, the files move; the settings do not. That is on purpose — otherwise going live would quietly push your test keys onto your real shop, or your real keys onto a draft you are still breaking things in. When you go live, ask for the real keys and you will get a second link for the live site.

What happens the moment you save

Your app restarts, because that is how it picks up something new.

On the draft, nobody notices — it is locked, so nobody is on it but you.
On the live site, it is offline for a few seconds. Anyone using it right then may see the page pause or reload. Nothing is lost, and it comes straight back. If your site is busy at a particular time of day, save outside it.

Hatchik tells you which of the two just happened, every time.

Ordinary settings are different

Not everything is a key. A support email address, your business name, a switch that turns a feature on — Claude can set those straight from the chat, with no link, because there is nothing to protect. Just say what you want.

Claude will refuse to do that for anything that looks like a key or a password, even if you ask it to. That refusal is the feature.

If a key gets out

It happens: pasted in the wrong window, in a screenshot, in a file you sent someone.

Go to the service that issued it — Stripe, Google, your email provider — and delete or roll that key there. This is the step that actually matters. Until you do it, the key works no matter what you do on Hatchik.
Get a new one from them.
Ask Claude for a link and paste the new one in. It replaces the old one.

Removing a key from Hatchik stops *your app* using it. It does not stop the key working everywhere else, so never treat it as the fix on its own.

What Hatchik will not do

Show you a key you saved. Once it is in, it is in. If you have lost it, get a fresh one from the service that issued it — they all let you.
Put a key in your download. Your download lists the names of your keys with the values left out, so you know exactly which ones to paste in wherever you go next. A download gets emailed and copied around; a live key inside one is a key loose in the world.
Change the settings Hatchik manages for you, like your database address. Your app already receives those automatically.

The same page as plain text, for an AI or anything else that prefers it: /docs/app-settings.md