Skip to content

How API Keys and Secrets Work

A plain-language guide to the keys that power WorkWingman: what they are, where they live, and who pays for them.

What Are API Keys?

API keys are like digital security badges. They allow WorkWingman to talk securely to external services (like AI providers or document storage) to perform actions on your behalf.

Bringing Your Own Keys (BYOK)

WorkWingman uses a Bring Your Own Key (BYOK) policy for desktop users: - No Automatic Accounts: WorkWingman never creates accounts or generates paid API keys on your behalf. - You Stay in Control: You decide which services to connect by entering your own keys into the app settings.

Free vs. Paid Features

  • Free by Default: Core features and free data sources work out of the box without extra setup.
  • Hidden Until Unlocked: Advanced features that require paid API access stay hidden or off until you supply the corresponding key.

Where Secrets Live

Your keys and credentials are stored depending on how you run WorkWingman: - Desktop App: Stored locally on your own computer inside your operating system's secure vault. - Cloud Edition: Managed in secure cloud secret vaults (GCP Secret Manager) operated by system administrators. - Developer Machines: Stored in a local ~/.fleet-secrets/ directory on developer computers and never shared or uploaded.

Who Pays for What?

  • Desktop Users: You pay your chosen API vendors directly according to your personal plan with them. WorkWingman charges no middleman fees for API calls made with your keys.
  • Cloud Edition: Cloud organization administrators manage central API billing and token consumption.