· 18 min read
You can't ship an API key in a one-click deploy template
A one-click deploy template that shows account data has a problem no tutorial mentions: it lives on a public URL, so it can't hold a shared API key without handing every visitor the whole account. Here's how we shipped an inbound-email inbox to the Railway marketplace as one deploy: the OAuth self-registration that replaces the key, one core that runs on six hosts, and a Connect button that wires the webhook for you.