> ## Documentation Index
> Fetch the complete documentation index at: https://kavenio.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform keys

Platform keys let a workspace use its own provider app credentials for supported
social platforms instead of Kavenio-managed defaults.

Use platform keys when your team owns the provider app, needs platform approval
under your business, or wants connections and refreshes to use your app
credentials.

## How it works

Kavenio supports two connection modes.

<CardGroup cols={2}>
  <Card title="Kavenio-managed apps" icon="shield-check">
    Use Kavenio-managed provider applications to start connecting supported
    social accounts without creating every platform app first.
  </Card>

  <Card title="BYOK for platform apps" icon="key">
    Add your own provider app credentials to Kavenio. New connections use your
    app while Kavenio handles OAuth, encrypted credential storage, refresh, and
    publishing.
  </Card>
</CardGroup>

When a workspace platform key exists and is verified, Kavenio uses it before
falling back to the Kavenio-managed default for that platform.

## Configure a workspace key

Open **Settings -> Platform Keys** in the dashboard.

Each platform row shows:

* the platform icon and name;
* current status;
* the configured app suffix when available;
* a **Manage** action.

The manage sheet accepts the fields required by that provider. Secret values are
write-only. Kavenio does not return client secrets, app secrets, consumer
secrets, developer tokens, access tokens, refresh tokens, or encrypted
credential values in API responses.

After saving, Kavenio tests the key. Some providers require a real OAuth flow to
prove the app credentials. Those providers show an OAuth-test-required status
until a connection flow verifies the app in practice.

## How Kavenio chooses keys

Kavenio resolves platform app credentials in this order:

1. The app credential linked to the connected account.
2. The workspace platform key.
3. The Kavenio-managed system default.

When you add a verified workspace key, new connections and supported refresh,
publishing, and ads operations use that key.

## Rotate or reset a key

Use **Manage** to rotate values. Existing account tokens may continue to work if
the provider keeps grants valid after app secret rotation.

Use **Reset** when the key must be tested again before Kavenio should trust it.

Use **Disable** when the key should no longer be used.

If a reset or disable means existing accounts can no longer refresh or publish,
use **Mark reconnect**. Kavenio marks linked connected accounts as needing
reconnect, and users can reconnect through the normal account connection flow.

## CLI

The CLI exposes the same platform key operations.

```bash theme={null}
kavenio platform-keys catalog
kavenio platform-keys list
kavenio platform-keys get --credential-id aaaaaaaaaaaaaaaa
```

Store key values in a local JSON file:

```json youtube-app.json theme={null}
{
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret"
}
```

Save and test:

```bash theme={null}
kavenio platform-keys upsert \
  --platform youtube \
  --values-file youtube-app.json

kavenio platform-keys test \
  --platform youtube \
  --credential-id aaaaaaaaaaaaaaaa
```

Lifecycle actions:

```bash theme={null}
kavenio platform-keys disable --credential-id aaaaaaaaaaaaaaaa
kavenio platform-keys reset --credential-id aaaaaaaaaaaaaaaa
kavenio platform-keys mark-accounts-needs-reconnect \
  --credential-id aaaaaaaaaaaaaaaa
```

Admins can manage system defaults by adding `--scope system`.

## Related docs

<CardGroup cols={2}>
  <Card title="Connect a social account" icon="plug" href="/docs/guides/connect-social-account">
    Connect accounts after configuring platform keys.
  </Card>

  <Card title="CLI" icon="terminal" href="/docs/cli/overview">
    Use platform key commands from scripts and agents.
  </Card>
</CardGroup>