---
title: "Call Stripe or Brevo with no key in your code, with while.sh"
url: https://while.sh/en/guides/api-keys-out-of-code/
author: "Aloïs Oddon, co-founder of Nextmap"
updated: 2026-11-02
---

# Connect Stripe, Brevo or any API to your app with no key in the code, from your AI agent

An API key in the code always ends up leaking: in a repository, a log, a conversation with your agent. With while, your app calls Stripe or Brevo without ever holding the key, and every call is recorded.

## Prerequisites

- An app, already on while or ready to deploy.
- The key for the API you want to connect, from Stripe or Brevo for example.
- An AI agent that works in a terminal: Claude Code, Codex, Cursor or Gemini CLI.

## Step 1: Give your agent these instructions

Open your agent in your app's folder and paste these instructions into it:

```text titre="Instructions"
Connect to while with my account (while.sh/agents), then deploy my app.
```

Your agent adds while's MCP server itself. If it asks you to, restart it. On the first call to while, a page opens in your browser. In Claude Code, if it doesn't open, type /mcp, choose while, then Authenticate. On that page, choose "A new app", then click Authorize.

## Step 2: Paste the key into while

Your agent declares the connection to Stripe and gives you a link. You open it, paste the Stripe key and approve. Your agent never sees it (source 1).

## What your agent does

It adds the connection to the service, in while.yaml:

```yaml titre="while.yaml"
services:
  - name: web
    port: 3000
    connections: [stripe]
```

Your app receives while's address for Stripe in `STRIPE_URL`, and calls it without a key:

```js titre="server.js"
const r = await fetch(`${process.env.STRIPE_URL}/v1/balance`);
const solde = await r.json();
```

The key is added to every call, and every call is recorded. For the first 7 days, reads go through, and while learns from them what your app calls. A write, like a payment or an outgoing email, goes through as soon as you approve its rule. After that, an unexpected call is refused, and your agent is notified.

## Allow a new call

> You, to your agent: Allow creating customers in Stripe.

Your agent proposes the rule, and you approve it in while. Your app then creates its customers, and anything you haven't allowed is still refused.

## Ask for your approval before a sensitive call

> You, to your agent: Ask me before every refund.

Your agent sets a rule on refunds: each one waits for your approval in while before it goes out to Stripe.

## Change the key

> You, to your agent: We need to change the Brevo key.

You paste the new key into while, and your app uses it from the very next call, with no new deployment.

## See your app's calls

> You, to your agent: Why did sending emails fail yesterday?

Your agent reads the latest call and the refused calls on the Brevo connection in while, and fixes the problem.

## Connect Google with no key to keep

> You, to your agent: Connect Google Sheets to our app.

Your agent declares the connection to Google. Depending on what you choose, a service account's key stays in while, or there is no key at all: short-lived tokens, signed for your app, that Google exchanges.

## Go back to the previous version

> You, to your agent: Go back to the previous version.

In the 30 minutes after a deployment, the previous version comes back in a second. After that, it takes a few seconds. Once the previous version is back, your agent reads what broke in while's logs, fixes it and deploys again.

## Next steps

- [Call Claude or GPT from your app without exposing the key](/en/guides/call-llm-api-without-exposing-key/)
- [Deploy a Node.js API and its PostgreSQL database](/en/guides/deploy-node-api-postgresql/)
- [Security on while](/en/security/)

## Sources

1. [Stripe, keeping your API keys safe](https://docs.stripe.com/keys), 2026-11-02

## Questions

### Can my agent see the key?

No. You enter it in while, never in your agent or in your code, and it is added to every call.

### Do I need to change my code?

Hardly: your app calls the address it receives in STRIPE_URL instead of Stripe's, and stops sending a key.

### Which APIs work?

Any HTTP API: a key in a header or in the URL, Basic, Bearer, OAuth2, or a signed token, as with Google, Salesforce or Microsoft.

### What if my app is hacked?

The key isn't in it, so it doesn't leak with the code. And nothing goes through beyond the calls your app usually makes.

### How many APIs can I connect?

One API with a key on the Free plan, and 25 on the Pro plan.