Tokens stay on the server. Keys are shown once.
Social login tokens, AI provider keys and webhook secrets are encrypted with the application key. API keys and invite tokens are stored only as hashes.
Access
A person acts through an organization membership. Permissions and workspace limits apply in the app and on API keys. Platform admins are a separate login with required two-factor authentication.
Publishing
A publish job records provider errors without secrets. If a network rejects the token, the account is marked needs reauth and pending sends to that account pause.
If the application key is lost
Encrypted fields cannot be read. Keep the application key apart from database backups. Card numbers are entered at the payment provider, not stored here.