Stage 1 · Lesson 7 of 8
API keys and OAuth
Apps need to know who is calling them. The simplest way is an : a long secret sent in a with each request. Whoever holds the key can act as that account, like a spare house key.
So store it in the tool's credentials section, never in a workflow field or a shared document. is the "Sign in with Google" style of connecting. The account owner approves a set of permissions, called scopes.
The tool then receives a token, a pass that can be revoked (switched off) at any time without changing a password. Most built-in use OAuth. Custom HTTP calls often need a key.
This matters later when you build for clients: whose account a credential belongs to decides who controls the data.
Common trapapproving every scope offered when you need two.
A question to check yourself, an AI practice session and 2 cheat sheet entries come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- GuideFreeMDN: HTTP
Mozilla · Beginner
Read the overview, methods, status codes and headers pages: the HTTP every automation tool sits on
- GuideFreeJavaScript.info
Ilya Kantor
The JSON methods and objects chapters teach you to read and reshape the data each step passes on
Practise
Keep handy
Also worth your time
Status codes, pagination, idempotency and rate limits from the API side, so you know what to expect as a caller