# Keys, passwords and other settings

Most apps need one thing they cannot make up for themselves: a key. Taking a
card payment needs a key from the payment company. Sending an email needs one
from the email company. Letting people sign in with Google needs one from
Google. It is a long string of letters and numbers that proves your app is
allowed to use that service, and it is the nearest thing your business has to a
house key.

You do not need to understand any of that. You need to know three things.

## 1. Never paste a key into the chat

Not to Claude, not to anyone. Once a key is in a conversation it is in the
record of that conversation, and that record does not go away when you close the
window. Anyone who ever sees it can spend your money, read your customers'
details or send email as you, and nothing about deleting the message takes it
back.

So Hatchik does not accept keys in chat, and Claude is told to refuse them. Say
what you are trying to do — "I want to take payments" — and you will get a
private link instead.

## 2. The link

Claude sends you a link. You open it, and it asks for exactly the keys your app
needs, each with a line saying what it is and where to find it. You paste them
in and press save.

- The link works **once** and lasts **an hour**. Ask for another any time.
- You do not sign in to use it. The link itself is the permission, and all it
  can do is put those named keys into that one site — it cannot read anything.
- What you type is stored scrambled, and it is never shown again. Not to you,
  not to Claude, not on your project page, not in your download. Claude is told
  it worked, and nothing else.
- Some keys are ones nobody has to fetch — the long random string an app uses to
  keep people signed in, for instance. Hatchik invents those itself, so there is
  no link and nothing for you to do.

## 3. Your draft and your live site keep separate keys

This is the part nobody expects, and it is worth knowing, because it is what
lets you build safely.

Every project has a **locked draft**, which you open from your project page
and nobody else can, and a **live site** that the public sees. They keep their own separate settings. Payment companies
give you two sets of keys — test ones, which pretend to take money, and real
ones, which actually do. So:

- Put the **test** keys on your draft. Buy your own product with a pretend card.
  Check the confirmation email arrives, the order shows up, the whole thing
  works.
- Put the **real** keys on the live site, when you are ready to open.

The same app behaves correctly in both places, because it just reads whichever
key it was given. You never have to change the app to go live.

**Publishing does not carry keys across.** When you make your draft live, the
files move; the settings do not. That is on purpose — otherwise going live would
quietly push your test keys onto your real shop, or your real keys onto a draft
you are still breaking things in. When you go live, ask for the real keys and
you will get a second link for the live site.

## What happens the moment you save

Your app restarts, because that is how it picks up something new.

- On the **draft**, nobody notices — it is locked, so nobody is on it but you.
- On the **live site**, it is offline for a few seconds. Anyone using it right
  then may see the page pause or reload. Nothing is lost, and it comes straight
  back. If your site is busy at a particular time of day, save outside it.

Hatchik tells you which of the two just happened, every time.

## Ordinary settings are different

Not everything is a key. A support email address, your business name, a switch
that turns a feature on — Claude can set those straight from the chat, with no
link, because there is nothing to protect. Just say what you want.

Claude will refuse to do that for anything that looks like a key or a password,
even if you ask it to. That refusal is the feature.

## If a key gets out

It happens: pasted in the wrong window, in a screenshot, in a file you sent
someone.

1. Go to the service that issued it — Stripe, Google, your email provider — and
   **delete or roll that key there**. This is the step that actually matters.
   Until you do it, the key works no matter what you do on Hatchik.
2. Get a new one from them.
3. Ask Claude for a link and paste the new one in. It replaces the old one.

Removing a key from Hatchik stops *your app* using it. It does not stop the key
working everywhere else, so never treat it as the fix on its own.

## What Hatchik will not do

- Show you a key you saved. Once it is in, it is in. If you have lost it, get a
  fresh one from the service that issued it — they all let you.
- Put a key in your download. Your download lists the **names** of your keys
  with the values left out, so you know exactly which ones to paste in wherever
  you go next. A download gets emailed and copied around; a live key inside one
  is a key loose in the world.
- Change the settings Hatchik manages for you, like your database address. Your
  app already receives those automatically.