Credentials you'll need (and how to handle them)

The platform never needs a client's main login password. It uses scoped, revocable credentials for each integration. Here's exactly what to collect and where it goes.

What each integration needs

• Search Console, a Google sign-in (OAuth), read-only. Nothing to store; the client grants access in a popup. Revoke anytime in their Google account.
• WordPress (optional), the WordPress username + an Application Password (Users → Profile → Application Passwords). NOT the login password. Entered as username:application_password.
• Webflow / Sanity, an API token with editor rights (Webflow: Site API token; Sanity: an editor token, reference projectId|dataset).
• Keyword / analytics data, an API key on the Connections page, if you use a paid data source.
• The snippet, no credential; it's a public script tag carrying only the project ID.

Where it's stored

• Secrets are stored per project and readable only by the project owner.
• They're never sent back to your browser, the UI only ever shows that a key exists, masked.
• They're used server-side to pull data or apply fixes; the client's browser never sees them.

The rules (follow these)

• Use Application Passwords / API tokens, never the account's main password.
• Give the least access that works, read-only for data, an Editor (not full admin) WordPress role where possible.
• Never paste a secret into chat, email, or a ticket. Enter it directly into the connect form.
• Revoke a credential the moment a client offboards, or if one was ever shared or exposed.
• Rotate anything you suspect leaked, and re-enter the new value.

A simple intake list to send a client

• Website URL.
• Search Console access (add you as a user, or a 2-min screen-share to sign in).
• For WordPress publishing: an Administrator/Editor username + a freshly-created Application Password.
• Any brand notes (name, primary colour) for white-label reports.