Authenticate Requests
Many endpoints require a credential. A linked service can attach one request header whose value is stored as a secret:
- Header name — the header to send, e.g.
AuthorizationorX-Api-Key. - Secret value — the value, e.g. a bearer token or API key.
Seekdown adds this header to the request from the server. The secret is stored securely and is never returned to the browser, included in the public assistant configuration, or written into a configuration backup — the editor only ever shows whether a secret is set, not its value.
Static secret vs forwarded token
Use a stored secret when the credential is the same for every visitor (a service API key). To pass a per-user credential instead, don't store a secret — add a header whose value is Bearer {{params.token}} under Pass dynamic values and supply the token when the assistant starts.
Set, Replace or Remove the Secret
- Set / replace — type a value in Secret value and save. A new value replaces the
stored one.
- Keep — leave the field blank when editing an existing service; the stored secret is
preserved (the field shows a "leave blank to keep" placeholder).
- Remove — use Remove stored secret to delete it. The header is then sent without a
credential (or not at all, if you also clear the header name).
Put the credential in the header, not the URL
Attach secrets as the authentication header rather than embedding them in the URL. The header value is kept on the server; a token placed in the URL is easier to leak through logs and referrers.
Related Docs
- Deploy an assistant — keys and origins for the assistant itself.