GuidesConnections

Connections

A connection is an outside service your app calls: a booking system, a payment provider, your own API. You find them in the studio under App → Connections.

Add a connection

Ask the agent, for example: “Connect to our stock API at https://api.example.com and show the stock level on each product page.” The agent adds the connection to the app. It then appears in the Connections tab with its name and address.

If the tab says the app has no connections, none has been added yet.

Set its secret

Most services need a key or token. Secrets are set here, never in the chat, and never stored in the app’s files.

  1. Click Set secret next to the connection.
  2. Choose how the service takes it:
    • Bearer token
    • API key in a header — and enter the header name (X-Api-Key is filled in for you)
    • User and password — written as user:password
  3. Only send it to — the address the secret may be sent to, for example https://api.example.com. It is filled in from the connection’s address.
  4. Paste the Secret and click Save secret.

The row then shows Secret set · sent only to that address. The secret is kept sealed on PhiWebs’ servers. It is used by the preview and, when the app is published, by the live app. Publishing sends it to the live app again, and an app that is already live gets a changed secret straight away.

To replace a secret, click Change and enter the new one. To remove it, click Remove and confirm.

How the secret stays safe

Your app never sees the secret. It calls the service through its own address, and PhiWebs adds the secret on the way, but only when the request goes to the address you named under Only send it to. That address is taken from what you entered here, never from the app’s files, so a change to the app cannot send your secret somewhere else.

Microsoft Graph

A Microsoft Graph connection works differently: it uses each visitor’s own Microsoft sign-in, not a stored secret. To check the app registration, click Sign in to Microsoft and then Test. For this check, the registration’s redirect URIs must include the studio’s address followed by /auth/callback; the tab shows the exact address.

See also

RecordsCollaboration