Data and credentials

Your application talks to Millwork with a Millwork API key. For models Millwork provides, Millwork manages the provider credentials. If you connect your own provider account, complete its documented browser setup. A receipt, the record of a run, never contains your prompt or the model output. This page covers what you may send during the private preview, where credentials belong, what your team can see, and what to do if a credential leaks.

​

Where each credential belongs

OpenRouter uses browser approval; you do not enter an OpenRouter key. For other providers, follow the setup method shown before supplying credentials. Your application never sends a provider credential. For your own provider account, use its connection_id after setup. Millwork never returns provider credentials in API responses.

​

What data you may send

Use only public information or test data you created for the evaluation. Do not send confidential company information, customer data, personal data, secrets, or regulated data. Each run names the kind of data you allow (data_classes). Set public for public information. Set sandbox for examples you invented for testing. The sandbox label describes your data. It is not a protection and provides no additional privacy or isolation. Requests that use tenant_internal are rejected during the private preview. Every live run has a platform fee, charged when Millwork accepts it. Read Model access and billing.

​

What Millwork keeps out of responses

• your provider key, in any form;
• any other organization’s name, members, or connections;
• the provider accounts behind the models Millwork provides;
• the provider’s raw error message (you get a short reason code instead);
• your prompt and the model output, inside a receipt.

​

Who on your team can do what

Give each person the smallest role that covers their work. A role change takes effect at the next sign-in. An existing dashboard session keeps its previous role until then. Ask the person to sign out and sign in again before relying on the new access. If a person’s account may be compromised, email support immediately.

​

If a credential may be exposed

If you suspect a key is exposed, revoke it promptly. This can interrupt the application until you configure a replacement.

• For a Millwork API key, revoke it in the dashboard.
• For a provider key, revoke it in the provider’s controls and disconnect it from Millwork with millwork provider disconnect <connection-id>. Run millwork provider list first for the connection ID. Disconnecting alone does not revoke the provider key. Use the provider’s own controls.

Then configure a replacement and email Millwork support with the key ID or connection ID. Never include the secret itself. For routine replacement when no exposure is suspected, test and switch to the new key before revoking the old one. Follow Replace an organization key or Replace a provider key.