Skip to main content
The Secrets API is the safe way to give Kardow the third-party API keys your integrations need — candidate-enrichment providers (PeopleDataLabs, Apollo), webhook signing keys, or any future integration credential.

​
How it works

  1. You store a secret once with a name (pdl_api_key) via this API, the dashboard, or the AI connector (MCP).
  2. The value is encrypted at rest in the platform vault (Supabase Vault). It can never be read back through any API — list calls return names and dates only.
  3. Feature config references the secret by name using the vault: scheme. For example, an enrichment provider’s header config:
At run time the platform backend injects the real value into the outbound request. The plaintext never appears in your config, in API responses, or in logs.

​
Secret names

Lowercase letters, digits, _ and -, up to 64 characters. Storing a secret under an existing name replaces its value (handy for key rotation — no config change needed, since config only holds the name).

​
Scopes