Glossary
Read-only key
An API credential scoped so it can look, never touch.
What it means
A read-only key is an API token granted view permission and nothing else — it can fetch your numbers and cannot change them. Many services issue them alongside, or instead of, full-privilege tokens.
Why it matters
Pasting a key into an app is an act of trust measured in what the key could do if the app were wrong about itself. Read-only is how a dashboard can be honest about its intentions.
How notchos does it
All twenty-seven integrations take read-only keys, stored in the app’s local storage, used by the app itself. There is no notchos server in the middle making requests on your behalf.
Fair questions
- Where do I get a read-only key?
- From each service’s own settings — GitHub, Stripe, Plausible, and the rest each issue restricted tokens; the Services dashboard links to the right page.
- What if a service has no read-only mode?
- Then the integration treats the key as read-only anyway — it only ever calls the viewing endpoints.
Related terms
Twenty tools. One hover. $9.99, once.