Resource access
Ownership, organization membership, and explicit project access are verified on protected server routes.
Security
Security and credentials
Keep access decisions on the server and secrets out of browser-visible workspaces.
Updated August 18, 2026 · 9 of 13
API credentials
Bearer, API-key, Basic, and OAuth client credentials can be stored separately with redacted editor responses.
Outbound proxy
A Module can configure one encrypted HTTP/HTTPS proxy for server loaders and credential tests.
Application secrets
Secret environment values stay server-side and are excluded from preview props, public config, logs, and committed source.
Never store a secret in normal Module JSON. General-purpose Module secret maps are not a durable publishing contract. Use encrypted Module API credentials for authoring-time server calls and Application environment secrets for deployed applications.