Can my agent see the key?

No. You enter it in while, never in your agent or in your code, and it is added to every call.

Do I need to change my code?

Hardly: your app calls the address it receives in STRIPE_URL instead of Stripe’s, and stops sending a key.

Any HTTP API: a key in a header or in the URL, Basic, Bearer, OAuth2, or a signed token, as with Google, Salesforce or Microsoft.

What if my app is hacked?

The key isn’t in it, so it doesn’t leak with the code. And nothing goes through beyond the calls your app usually makes.

How many APIs can I connect?

One API with a key on the Free plan, and 25 on the Pro plan.

Call Stripe or Brevo with no key in your code, with while.sh

An API key in the code always ends up leaking: in a repository, a log, a conversation with your agent. With while, your app calls Stripe or Brevo without ever holding the key, and every call is recorded.

Prerequisites

An app, already on while or ready to deploy.
The key for the API you want to connect, from Stripe or Brevo for example.
An AI agent that works in a terminal: Claude Code, Codex, Cursor or Gemini CLI.

Step 1: Give your agent these instructions

Open your agent in your app’s folder and paste these instructions into it:

Instructions

Connect to while with my account (while.sh/agents), then deploy my app.

Your agent adds while’s MCP server itself. If it asks you to, restart it. On the first call to while, a page opens in your browser. In Claude Code, if it doesn’t open, type /mcp, choose while, then Authenticate. On that page, choose “A new app”, then click Authorize.

Step 2: Paste the key into while

Your agent declares the connection to Stripe and gives you a link. You open it, paste the Stripe key and approve. Your agent never sees it¹.

What your agent does

It adds the connection to the service, in while.yaml:

while.yaml

services:
  - name: web
    port: 3000
    connections: [stripe]

Your app receives while’s address for Stripe in STRIPE_URL, and calls it without a key:

server.js

const r = await fetch(`${process.env.STRIPE_URL}/v1/balance`);
const solde = await r.json();

The key is added to every call, and every call is recorded. For the first 7 days, reads go through, and while learns from them what your app calls. A write, like a payment or an outgoing email, goes through as soon as you approve its rule. After that, an unexpected call is refused, and your agent is notified.

Allow a new call

You, to your agent: Allow creating customers in Stripe.

Your agent proposes the rule, and you approve it in while. Your app then creates its customers, and anything you haven’t allowed is still refused.

Ask for your approval before a sensitive call

You, to your agent: Ask me before every refund.

Your agent sets a rule on refunds: each one waits for your approval in while before it goes out to Stripe.

Change the key

You, to your agent: We need to change the Brevo key.

You paste the new key into while, and your app uses it from the very next call, with no new deployment.

See your app’s calls

You, to your agent: Why did sending emails fail yesterday?

Your agent reads the latest call and the refused calls on the Brevo connection in while, and fixes the problem.

Connect Google with no key to keep

You, to your agent: Connect Google Sheets to our app.

Your agent declares the connection to Google. Depending on what you choose, a service account’s key stays in while, or there is no key at all: short-lived tokens, signed for your app, that Google exchanges.

Go back to the previous version

You, to your agent: Go back to the previous version.

In the 30 minutes after a deployment, the previous version comes back in a second. After that, it takes a few seconds. Once the previous version is back, your agent reads what broke in while’s logs, fixes it and deploys again.

In the docs: Outbound traffic, API connections and Versions and rollback.

Connect Stripe, Brevo or any API to your app with no key in the code, from your AI agent