How your Anthropic API key is encrypted
Olvio answers your shoppers with Claude using your own Anthropic API key. Olvio encrypts the key before storing it, saves only the encrypted version in its database, and never displays the key again. This article explains how the encryption works, when Olvio uses your key, and how to replace or delete it.
The API Key page is in the Olvio app menu while you have a plan.
What happens when you save your key
You paste the key into the API key field on the API Key page and click Save. The key travels to Olvio over an encrypted HTTPS connection.
Olvio cleans up characters that can slip in when a key is copied from a formatted document: it removes spaces, invisible characters and curly quotes, and turns look-alike dashes back into hyphens. It then checks that the key looks like an Anthropic key, starting with
sk-ant-.Olvio sends Anthropic a very small test request with your key and the selected Claude model. Anthropic bills this request like any other.
If the check succeeds, Olvio encrypts the key and saves only the encrypted version in its database. You see Settings saved, the field empties, and the Status badge shows Connected.
If a check fails, nothing is saved and the key you had before, if any, stays in place. For the error messages and what to do about them, see 'Invalid Anthropic key' error when saving.
How the encryption works
Olvio encrypts your key with AES-GCM and a 256-bit encryption key, using the Web Crypto functions built into its hosting platform rather than a cryptography library of its own.
Each encryption uses a new random 12-byte initialization vector, so encrypting the same key twice gives two different results.
Your store's
.myshopify.comdomain is bound to the encrypted key as additional authenticated data and is checked on every decryption. If the encrypted key were copied into another store's record, decryption would fail instead of returning your key.AES-GCM also detects tampering: an encrypted key that has been altered can't be decrypted.
Where your key is kept
The encrypted key is stored in Olvio's database, hosted by Cloudflare in the Western Europe region. To answer shoppers faster, Olvio also keeps short-lived copies of the encrypted key in its cache, which runs on Cloudflare's global network and isn't restricted to the European Union. The database and the cache only hold the encrypted version. See Where is my data hosted? for details.
The encryption key that locks and unlocks stored API keys is kept as a secret in Olvio's hosting environment, separate from the database, and isn't part of Olvio's source code. A copy of the database alone isn't enough to decrypt the keys it holds.
When Olvio uses your key
Olvio decrypts your key in memory only when it needs it, for example to send a request to Claude for your store or to check your key against a newly selected model. Olvio never writes the decrypted key to its database or cache.
Your key leaves Olvio only to authenticate requests to Anthropic, which are sent over HTTPS through Olvio's hosting provider, Cloudflare. For the features that send requests with your key, see What uses your Anthropic API key, and what doesn't.
Who can see your key
The API Key page never shows your key. Once a key is saved, the API key field shows dots in its place, and the page only receives whether a key is saved, not the key itself. There's no option to reveal it, so if you lose your key, create a new one in the Claude Console.
The internal read-only console Olvio (Topicimes) staff use for support, incident diagnosis and quality control shows your store's dashboards and conversations, but not your API key. See What data Olvio stores about your store.
Olvio masks Anthropic API keys in the error messages it writes to its application logs. When Anthropic rejects a key, whether it's a key you paste or your saved key checked again after you change the model, the logs keep the key's length and its last 4 characters. When a key you paste is rejected because it doesn't look like an Anthropic key, the logs also keep its first 14 characters. This helps diagnose copy-paste problems.
Replace your key
Replace your key when you want to rotate it, move to another Anthropic account, or think it may have been exposed.
Create a new key in the Claude Console. Scope it to a single workspace and choose its expiration, as described in Connect your Anthropic (Claude) API key.
In the Olvio admin, open API Key. The API key field shows the hint Leave empty to keep the current key. Enter a new key to replace it.
Paste the new key and click Save.
Olvio checks the new key with Anthropic, encrypts it and replaces the old encrypted key in its database. If the check fails, your current key stays in place. Once the new key works, disable or delete the old one on the API keys page of the Claude Console so it can't be used anywhere else.
If you think your key has been exposed, you can disable or delete it on the API keys page of the Claude Console straight away, before you create a new one. Olvio can't answer shoppers until you connect the new key.
Delete your key
Click Delete key on the API Key page. The button only appears when a key is saved, and there's no confirmation step: Olvio removes the encrypted key from its database immediately, you see Key removed, and the Status badge shows Not configured. Your Claude model choice is kept for when you connect a key again.
Without a key, the Olvio widget still shows on your product pages, but without suggested questions, and every chat message gets an error reply (Sorry, an error occurred. Please try again. in English). On the Growth and Scale plans, Olvio Advisor can't answer either. Deleting the key in Olvio doesn't disable or delete it at Anthropic: do that on the API keys page of the Claude Console if you no longer need the key.
When you uninstall Olvio
Uninstalling Olvio doesn't delete your key right away. About 48 hours later, Shopify asks Olvio to delete your store's data, and Olvio then deletes your store's record, including the encrypted key. To remove the key immediately, click Delete key on the API Key page before you uninstall, while you still have a plan. See What happens to my data when I uninstall Olvio.