Skip to main content
  • Store credentials once under Manage tokens
  • Reference tokens in HTTP action headers with @ (inserts {{token.<name>}})
  • Support static value (server secrets), customer login (per-user OAuth), and the agent BFF pattern (static service token + {{end_user_id}})

​
Open Manage tokens

From Available actions, click Manage tokens, or go directly to Actions > Manage tokens in the sidebar.
1

Create a token

Click New token, choose a type, and save. Token names must start with a letter and use lowercase letters, numbers, and underscores only (e.g. my_api).
2

Reference in an action

On an HTTP action’s Headers field, type @ to open the token picker. The selected token is inserted as {{token.<name>}}.
3

Test the action

Use the action test panel. Resolved token values are never shown; headers appear censored in logs.

​
Token types

When you click New token, choose Retrieve token from:

​
Static value tokens

Use for backend credentials your agent always sends (e.g. Authorization: Bearer ... for your internal API or agent BFF).
After save, the dashboard shows a censored preview. Plaintext values are never returned from the API.

​
Agent BFF (signed-in apps)

For mobile and web apps where users already sign in to your product, you usually should not pass their API bearer token through chat. Instead:
  1. Create a static value token (e.g. my_bff) with a shared secret your backend validates.
  2. Point HTTP actions at your app’s agent BFF routes (not the customer’s API directly).
  3. Send the signed-in user id on every action call:
Your BFF validates the service token, looks up that user’s session or API credentials server-side, and proxies the request. See Fintech SaaS recipe and Pricepally ecommerce recipe for full BFF walkthroughs.
{{end_user_id}} resolves to the stable id you pass from the embed or SDK. Without it, Chatropic falls back to the anonymous chat session id, and BFF routes will not find the correct user.

​
Customer login tokens

Use when the external API must act on behalf of the signed-in customer (orders, account data, etc.). Configure: When a customer has not signed in, the agent returns a sign-in prompt instead of calling the API. After OAuth completes, subsequent turns use the stored per-user token.

​
Identity signing secret (customer login)

Customer login requires your embed or SDK integration to pass a stable end-user id so OAuth tokens persist across chat sessions.
  1. In the customer-login token dialog, generate an identity signing secret (shown once).
  2. On your backend, sign a short-lived JWT with HS256, including sub (end-user id) and exp.
  3. Pass the JWT and the end-user id to your integration: identityToken and endUserId in the React Native SDK, or the identity and endUser query params on the web embed URL.
See Authentication & identity for the integration wiring.

​
Syntax reference

Do not paste API keys directly into action URLs or headers. Use tokens so secrets stay encrypted at rest and censored in logs and traces.

Skills

Configure webhook steps and headers.

Authentication & identity

Pass endUserId and identityToken from your app.