Skip to main content
Workflow JSON can store literal data, but it must not contain raw passwords, OAuth tokens, cookies, webhook URLs, or signing keys. sndbox provides two reference types for sensitive values.

​
Protected variables

A protected-variable binding stores only its name:
The host resolves the value at execution. Sensitive fields redact it from logs and execution data.

​
Connections

AI connections use a provider API key and selected model. Gmail uses OAuth PKCE. Discord and Slack use incoming webhook connections. Metadata such as display name, provider, selected AI model, scopes, status, and last-used time is visible; the underlying secret stays in the operating-system credential vault. An AI connection can be referenced by the workflow builder, an AI node, or the Code editor’s Write with AI action. The provider receives the prompt and the workflow or code context needed for that request. It does not receive the vault record itself. You can test, rename, and revoke a connection in Settings → Connections. Before revocation, the UI identifies affected workflows. Revocation prevents later use without inserting the credential into workflow output.

​
Exports and sync

Exports contain required-connection metadata, never the secret. Cloud sync omits raw credentials, cookies, and browser profiles. Imports that contain secret-shaped raw material are rejected. For plugin credentials, the guest sends a typed credential_operation through the host. OAuth tokens are injected or refreshed inside the host and are never returned to guest memory.