Credentials you'll need (and how to handle them)

The platform never needs a client's main login password. Each connection uses its own scoped, revocable credential. Here's exactly what each one needs.

What each connection needs

• Search Console, Analytics and Business Profile: a Google sign-in, one per service. Nothing to store; the account owner approves access in a popup and can revoke it in their Google account.
• Bing Webmaster Tools: a Microsoft sign-in, or an API key from Bing Webmaster Tools.
• WordPress: no password at all. You download our plugin and someone with admin access uploads and activates it. It carries its own secret, made for that site only.
• Webflow: a site API token with read and write access to Sites, Pages, CMS and Assets.
• Next.js and Webhook: a secret you choose, which we send back with every request so the site knows it's us.
• The snippet: no credential. It's a public script tag carrying only the site's project ID.

Where it's stored

• Secrets are stored per project and readable only by the project owner.
• They're never sent back to your browser, the UI only ever shows that a key exists, masked.
• They're used server-side to pull data or apply fixes; the client's browser never sees them.

The rules (follow these)

• Use sign-ins, API tokens and the plugin, never an account's main password.
• Give the least access that works: read-only for data, a site-scoped token for Webflow.
• Never paste a secret into chat, email or a ticket. Enter it directly into the connect form.
• Revoke access the moment a client offboards, or if a credential was ever shared or exposed.
• Rotate anything you suspect leaked, and enter the new value.

A simple intake list to send a client

• Website URL.
• Search Console and Analytics access: add you as a user, or a two-minute screen-share to sign in.
• For WordPress: someone who can install a plugin, or invite their developer from the Onboarding website step.
• Any brand notes (name, primary colour) for white-label reports.