How connections work
A connection links an outside service, such as payments, email, or an AI service, to your app or to the agent. You connect each service once with a key or a sign-in, and FlutterFlow stores the key on its servers so that it never appears in your threads or inside your app.
Two kinds of connection
The two kinds live in two places. Project Settings › Connections holds the services this app uses. Your own accounts for the agent are in Account › Connections, which you open from the account menu, and the agent can use them in threads that you start in any of your apps.
| Your app’s connections (Project Settings › Connections) | Your own connections (Account › Connections) | |
|---|---|---|
| What it’s for | Services that your app uses, such as payments or email. The agent can also use them while it works on your app. | Your personal accounts at other services, for the agent to use in threads that you start. Your app never uses them. |
| Who it belongs to | Your app. | You. It follows you across every app that you work on, and nobody else can use it. |
| Who connects it | An owner of your app. | Each person connects their own accounts. |
App Store Connect and Google Play accounts are under App stores. Store accounts belong to your FlutterFlow account rather than to a single app. Only an owner of your account can connect, rename, or remove them in Account › App stores, and you choose which account an app releases with in Project Settings › App stores. See Store accounts.
How keys are kept
When you connect a service with a key, the service verifies the key before FlutterFlow saves it and rejects invalid keys immediately. FlutterFlow then seals the key and never displays it again, even to you. Your app and the agent call the service through FlutterFlow, so the key never enters your threads or your app.
To use a different key later, replace it. See Replace a key.
Who can connect
Only an app owner can connect a service in Project Settings › Connections, replace its key, or disconnect it.
In Account › Connections, each person connects their own accounts, and the agent uses those accounts only in threads that person starts.
When the agent asks first
When your request needs a service that your app hasn’t connected, the agent asks under Connect above the message box and waits. Only the person who started the thread can respond:
- If you’re an owner: Click the card’s button, such as Connect {Service} or Link to this project, or click Not now to skip it.
- If you started the thread as a developer: You see “Only a project owner can connect {Service}. Ask one to connect it in Project Settings › Connections, then continue here.”
- If someone else started the thread: You see “Only {name} can answer. You can follow along.”
Your own accounts in Account › Connections have per-action permissions: Always, Ask first, or Never.
By default, read-only actions run automatically, and every other action asks first. Before running an Ask first action, the agent shows the exact call details under Approval above the message box and waits for the person who started the thread to click Approve, Always allow, or Decline.
You can set an action that makes changes to Always only if the service marks it as one that doesn’t delete or overwrite data. Any other action that makes changes asks first unless you set it to Never, and its Approval card offers only Approve and Decline.
Test keys
If the service offers a test key, connect the test key while you build, because the calls that you make while you test are real calls.
Previews and the agent in your threads share your app’s connection to each service. When you use Replace key to swap a test key for a live key, previews and the agent switch to the live key too. Each connection belongs to the app where you added it; reusing a key from another app creates an independent copy, so replacing or disconnecting one leaves the other unchanged. See Manage connections.
“That looks like a provider secret key. Don’t paste credentials into the chat — ask for a secure field instead, and rotate this one.”
FlutterFlow shows this warning when it blocks your message because the text looks like a credential. The first sentence names what FlutterFlow detected, for example, “That looks like a private key.” or “That looks like a GitHub token.” FlutterFlow checks every message that you send in a thread before sending it, because a sent message stays in the thread, where the agent reads it. Your draft stays in the message box.
Because this check can’t catch every credential format, never paste a key into a message.
To continue:
- Delete the key from your message and send the message again.
- Rotate the exposed key at the service.
- If you’re an owner, connect the service in Project Settings › Connections, or ask the agent to use the service and connect it when the Connect card appears above the message box. Otherwise, ask an owner to connect it.