Project secrets
CRUD in the studio. Encrypted at rest with the host’s secret key.
Connectors
Use the APIs you already pay for. Keep the keys out of chat.
There is no marketplace of one-click Zapier tiles inside CodeLoom. There is generated fetch code plus project secrets. That is more honest. Whop, OAuth, and your third-party keys are the connectors that exist today.
Secrets
Ciphertext in the studio
Whop
This host’s Pro checkout
OAuth if env is set
GitHub
OAuth if env is set
Why this exists
Build from what you already use.
The working loop
Name the provider in the prompt: “list invoices from Stripe test mode.” Put STRIPE_SECRET in secrets. Tell the agent the env var name. If you paste the secret in chat, you have already lost.
Env
- OPENAI_API_KEY
- STRIPE_SECRET
- DATABASE_URL
- WHOP_API_KEY
In the product
What you actually get.
Whop on this site
We checkout Pro through Whop. Your generated app only gets Whop if you ask for it.
OAuth for CodeLoom accounts
Google/GitHub for signing into this host — not automatically into the app you generated.
Fetch + types
Ask for a typed client. Review the file. Do not assume PCI is handled.
Webhooks in their app
You can ask for a webhook route. Hosting it is on you after export.
No silent network
The sandbox allowlists npm/node. It will not sudo your VPS.
How
A path you can follow without a call.
01
Create the secret
Studio secrets. Name it like an env var.
02
Tell the agent the name
Not the value.
03
Ask for the call site
One screen, one request.
04
Verify in preview
Then export with a .env.example of your own.
Deep cut
The rest of the page — not a teaser.
Stripe
Ask for Checkout Session or Payment Element. Use test keys. We are not your Stripe account.
Supabase / Firebase
Describe tables. Put the URL and anon key in secrets. Service role never belongs in a browser bundle — say that in the prompt.
Resend / email
Server route + secret. Preview on this host must be able to call out.
Slack
Incoming webhook URL as a secret. Confirm the message shape.
Airtable / Notion
Possible via fetch. Rate limits are yours.
Whop (your product)
Copy the pattern we use: checkout config + webhook signature. Do not copy our keys.
Questions
Ask these before you waste a week.
Is this a mock or a real app?
Real Vite + React + TypeScript files in a project you own. Preview is a running Vite server proxied through the studio iframe.
What happens when I hit the token cap?
The agent stops until the month resets or you upgrade. Pro is $19.99/month via Whop card checkout. The webhook sets your plan to Pro.
Can I take the code?
Yes. Export a zip from the studio. Secrets are not stuffed into the zip as plaintext from the ciphertext store — add env files yourself after export.
Will the agent magically know my schema?
No. Paste a redacted schema or attach a file.
Next
Keep going.
Describe it. Watch it become real.
Free is live. Pro is $19.99/month on Whop. The studio, preview, and export are on this host — not a waitlist.