# Connections and secrets

> Workflows use your app accounts through connections, and your own API keys as secrets. Both are encrypted, used by name, and never shown in a workflow or to your AI.

Web page: https://docs.lodol.com/docs/concepts/connections

A workflow never holds a password or an API key. It names the account or key it needs, and Lodol supplies it when a step runs. That keeps credentials out of workflows, out of your AI tool's chat, and out of anything you share.

## Connections

A **connection** is your workspace's access to one of your apps, such as your Google account or your Slack workspace. App actions and triggers run through it.

- **You connect an app once.** When a workflow first uses an app your workspace hasn't connected, its step shows a **Connect** button. Some apps ask you to sign in; others ask for an API key from the app's own settings, such as a Stripe key from the Stripe dashboard.
- **Connections are shared.** Members of the workspace use its connections in their workflows, so an app is connected once for everyone.
- **AI models use your own key.** The [AI agent](https://docs.lodol.com/docs/guides/ai-agents.md) step runs on your connection to an AI provider such as Anthropic, OpenAI or Google Gemini, so the provider bills your account directly. Connect one under **Integrations** in Lodol.

Your AI tool can't connect apps for you: connecting always happens in Lodol, by someone in your workspace.

## Secrets

A **secret** is a key or password you add yourself, for a service that has no app in Lodol. A [Call an API](https://docs.lodol.com/docs/guides/http-and-code.md#call-an-api) step uses it by name, usually in an `Authorization` header.

- Secrets are encrypted at rest, and credentials are encrypted in transit.
- Workflows and AI tools see only a secret's name, never its value.
- A secret can belong to the whole workspace or to one workflow. Deleting a workflow keeps its secrets: they're detached from it, not deleted.

<Callout type="warn" title="An API call can't borrow an app's connection">
  A **Call an API** step sends only the secrets you give it. It can't use an app's connection, so calling Google's or Slack's API directly with it won't be signed in. For apps Lodol has, use their actions; keep **Call an API** for services Lodol doesn't connect to.
</Callout>

## Values

Values are named settings your workspace keeps that aren't secret, such as a base URL several workflows share. Steps read them as `@values.NAME`. Workflows can also save and update values as they run, to [remember things between runs](https://docs.lodol.com/docs/guides/stored-values.md).

## Next

<Cards>
  <Card title="Call an API or run code" description="Reach any service with an API, using a secret for its key." href="/docs/guides/http-and-code" />
  <Card title="Browse integrations" description="Every app you can connect, and what each one can do." href="/docs/integrations" />
</Cards>