Skip to content

Key security

How Velora protects your keys and sessions, and the habits to adopt.

4 min

Your API keys and sessions open access to your accounts on other services. Here's why it matters to you: a key lying around in a chat is an open door to your models' sales. This page explains what Velora does and what you need to do on your side.

Before you start

  • The Owner or Admin role in Velora.
  • The list of integrations you've connected.

Steps

  1. Know what Velora stores. Every key is encrypted with AES-256 using a key unique to your agency. Another agency can't read it.
  2. A key is never shown again. After you enter it, the console only shows the last 4 characters. To change a key, paste a new one.
  3. Only two roles touch keys. The Owner and Admins can add or remove a key. Other members only see whether the integration works.
  4. Everything goes into the audit log. Every key added, tested or removed is logged with the person and the time. Check it if you have a doubt.
  5. Create a key just for Velora. With each provider, create a key named Velora with the fewest rights possible, read-only when you can. You can cut it off without breaking your other tools.
  6. Never send it in a message. No keys on WhatsApp, Telegram, email or in a shared document. Paste it straight into the console.
  7. Change keys when someone leaves. If they had access to a key, create a new one with the provider, paste it into Velora, then delete the old one.
  8. MYM and Reveal sessions: private window. Copy the session in a private browsing window, then close the window. Never click Log out: it kills the session and notifications stop.
  9. Disconnecting deletes the key. When you disconnect an integration, the key is erased from Velora. To come back, you'll paste a new one.
  10. If a key has leaked. Picture this: a former member kept a screenshot with your key. First revoke the key with the provider, so it stops working everywhere. Then create a new key and paste it into Velora.

If it doesn't work

  • You don't see the button to add a key → your role isn't Owner or Admin, ask the Owner.
  • An integration fails after a key change → click Test and check the new key's rights.
  • A MYM or Reveal session dies for no reason → someone probably logged out of the account, paste a new session.

Official links

Next guideAI and MCP