Keep connections safe
Where to keep tokens and secrets, how to replace them, what to do if one leaks, and how to report a vulnerability.
On this page
Where to keep tokens and secrets
Keep tokens, URLs and signing secrets in a secret store or an environment variable, never in notes, chats or source code. Anyone who has one gets what it allows.
What each credential can do
| Credential | Gives | Replace it with |
|---|---|---|
A token (tp_…) | Everything the connection’s level allows | Replace token… |
| A URL that adds notes from another app | Adding notes to its one thread | Replace URL… |
A signing secret (whsec_…) | Signing requests that look like they come from ThreadPage | Replace secret… |
| An app’s or a coding agent’s sign-in | Everything its level allows | Disconnect…, then connect again |
| An AI model’s API key | Answers billed to your provider account | Replace key…, and revoke the old key with the provider |
Replace a token
Replace token… works at once: the old token stops working that moment, and the note-update URLs it added pause until you resume them. So your integration stops until the new token is in its secret store. Put it there in one step, then check that the token works.
To keep a token working past its term without replacing it, choose Renew: the same token, a new term. The connection’s details show when its token stops working.
If something leaks
- A token: choose Replace token…. Recent activity in the connection’s details shows what the token read and changed. Check its Note updates and delete URLs you don’t recognise.
- A URL that adds notes: choose Replace URL…. The old one stops working at once.
- A webhook’s signing secret (
whsec_…): choose Replace secret… and put the new secret in your workflow right away: requests forged with the leaked secret then fail your check, and ThreadPage’s own requests already carry the new signature. - An API key: revoke it with the provider and choose Replace key….
- When unsure: Disconnect… stops the connection and everything it uses at once.
Undo changes… in the connection’s details undoes what it changed, and Restore from Trash… brings back what it moved to Trash.
Untrusted text in notes
Notes from services, assistants and the people you share with can contain text written to mislead an assistant. ThreadPage marks who wrote each note, and tells assistants to treat note text as information, never as instructions.
What connections can never do
No connection can delete permanently, share, send notes with @, read drafts or private recovery versions, export or import, or change your account, plan, connections or notification settings.
Your password and connections
Changing or resetting your password stops every connection’s token. Connect apps and coding agents again, and create new tokens for scripts and workflows.
Report a vulnerability
Email [email protected] with “Security” in the subject. Include what you found and how to reproduce it; don’t include other people’s data. This applies to all of ThreadPage.