Where your login or key lives
SafeAssist stores your saved logins and API keys so your assistant can use them without ever seeing or keeping them. What you do depends on the service. This page is honest about what most people can get today.
Website logins (save in the dashboard)
Open Saved logins in the dashboard. Enter the site, username, and password for a site you use. You can reveal, copy, edit, or delete it there. The same saved login can be handed to your assistant for one task through SafeAssist without the assistant keeping the password.
GitHub (OAuth connection)
You do not paste a personal API token for normal assistant use. In the dashboard, open Connections and choose Connect GitHub. You sign in with GitHub once; SafeAssist keeps the access grant in the vault.
Email (Gmail, Outlook, and similar)
Most people do not have a single password or API key they can hand to an assistant for email. Providers expect you to sign in through their own screens (often called OAuth). SafeAssist is built for that pattern when a connector exists. There is no universal “copy this key from Settings” path we can document for every mailbox.
Calendar (Google Calendar, Outlook calendar, Apple)
Same story as email: you usually authorize an app through a sign-in flow, not by downloading a key from a settings page. If SafeAssist adds a calendar connector, you will connect it from the dashboard the same way as GitHub.
Shopping and retail accounts
Retail sites almost never give everyday users an API key. Your assistant should not ask you to paste your store password into a chat. When SafeAssist supports a retailer, it will use a proper sign-in connection, not a homemade key.
Travel (airlines, hotels, booking sites)
Travel accounts are login-based. They do not issue personal API keys for assistants. Treat any request to email your password as a red flag.
API keys (save in the dashboard)
Some services give you an API key: OpenAI, Anthropic, Stripe, and many developer tools. In the dashboard, open API keys, name the key, enter the service's API address (for example api.openai.com), and paste the key. After you save it, SafeAssist only ever shows its last four characters.
When your assistant needs the key, it asks SafeAssist to make the request. SafeAssist adds the key, sends the request, and passes back only the answer. Your assistant never sees the key, and every use appears in your Activity log.
How your API keys stay safe
- Each key is locked to the website you chose. Even if an assistant is tricked by a harmful web page into trying to send your OpenAI key to
evil.com, SafeAssist refuses, becauseevil.comis not that key's website. Look-alike addresses and other addresses on the same site are refused too, unless you list them on the key yourself. - Your key is wiped from every reply. Some services repeat part of the request back in their answers, including error messages. Without this step, an error message could hand your key straight to your assistant. SafeAssist removes it (including encoded copies of it) before your assistant sees anything.
Choose when your assistant asks you first
Each key has its own setting. New keys start on Ask every time.
- Ask every time: you approve each use before it happens.
- Ask before changes: lookups run on their own; anything that sends, creates, changes, or deletes waits for you. SafeAssist can only tell the two apart by the type of request, so some services (OpenAI is one) will still ask every time.
- Ask once per session: you approve once, then the same assistant can use the key for the next hour.
- Never ask: uses run straight away.
At every setting, the key stays locked to its website, it is wiped from replies, and every use appears in your Activity log. Even on Never ask, your assistant never sees the key. You can change the setting whenever you like, and each change is recorded in your Activity log, so you can see when a key was made less strict.
If your assistant builder asks for a SafeAssist key
That is a different kind of key: a connection key that lets an assistant or your own software talk to SafeAssist. Create those under Connection keys in the dashboard. If you are wiring software yourself, see the developer section.