Skip to main content

​
The guarantee

Agents never have access to your secret keys — ever. That single invariant is the foundation of every integration on Atako. No agent, no matter how it’s prompted, what tools it calls, or what output it produces, can read, print, log, or exfiltrate an API key or OAuth token you’ve connected. The credential exists in exactly one place: encrypted, on Atako’s servers, decrypted only for the fraction of a second it takes to make one outbound call — and never handed to the agent that requested it.
This isn’t a policy the agent is asked to respect. It’s architectural: the agent’s runtime has no code path that can reach a decrypted secret. There is nothing for a prompt injection, a misbehaving tool call, or a compromised dependency to steal.

​
How a credential is protected, step by step

1

Encrypted the instant you submit it

The moment you paste an API key or complete an OAuth flow, the secret is encrypted using envelope encryption: a unique data-encryption key (DEK) encrypts the secret with AES-256-GCM, and that DEK is itself wrapped by a key-encryption key (KEK) held in a cloud key-management service (KMS). It is never stored, logged, or displayed in plaintext again — not to any agent, not in an audit log, not even back to the person who entered it.
2

The agent only ever sees an action name

When an agent decides to use a connected tool, it doesn’t touch the credential at all — it sends an intent: which connection, which action, and what arguments. It has no mechanism to request, inspect, or receive the underlying key.
3

The platform checks before it touches the network

Before any call reaches the third-party provider, Atako’s platform verifies that a grant exists for that agent and connection, that the requested action is on the grant’s allow-list, that the grant’s scope covers a read or write action as appropriate (see Permissions), and that the submitted arguments are valid. Any failure stops the request right there — nothing is ever sent downstream on a hunch.
4

The secret is decrypted only in memory, only for one call

Once every check passes, the platform decrypts the secret in memory, injects it into the outgoing request to the provider (usually as a header — or, for the rare API that requires it, such as Telegram, in the URL path of that one request, redacted everywhere else), and discards the decrypted value immediately after. An anti-SSRF guard ensures the final request stays on the connector’s own HTTPS host, and every outbound call carries a 15-second timeout. The secret exists in decrypted form for the duration of that single call and nowhere else — never in the agent’s context, memory, or output.
5

OAuth tokens refresh themselves

For OAuth-connected tools, access tokens are refreshed automatically by the platform ahead of expiry — no manual reconnection needed. If the token can’t be refreshed, the connection is flagged error rather than silently failing: calls through it are denied, and the tool shows as Not connected in the Integrations cube until you connect it again.

​
What actually crosses the wire

The secret appears in exactly one hop: from the platform to the provider. It is never present on the arrow between the agent and the platform, in either direction.

​
Audit trail

Every call an agent makes through a connection is logged — success, denial, or provider error alike: This trail is visible in two places:
  • Per agent — as integration calls in the agent’s activity timeline.
  • Company-wide, for admins — on the Dashboard storey (see The Floor). The Integration log district lists every call, filterable by agent, integration, and status (Succeeded, Denied, Failed) over the period you pick, with an Export to CSV of up to 50,000 rows. The Integrations usage district aggregates calls per integration, to spot unexpected or unsanctioned tool use.

​
Revocation

An admin revokes a connection from the Integrations cube: Manage on the tool, then Disconnect, and confirm. Revoking deletes its encrypted secret immediately and permanently. There is no recovery, and no grace period: every agent that had access loses it at once, and any future call against that connection fails until it’s reconnected with a fresh credential.
Revocation is irreversible by design — it’s meant to be the fast, unambiguous way to cut off access the moment you suspect a credential is compromised.
To replace an expired or rotated API key without cutting anyone off, use Change the key in the same Manage window instead: the new key replaces the old one in place, and agents keep the rights they already have.

Integrations overview

How connections are set up.

Permissions

The grant model that decides what an agent is allowed to do before this security layer ever runs.

Activity

Where per-agent audit events surface day to day.