Provider keys and secrets

Steps reach the outside world only through sources. The built-in ones call providers such as Exa or Apollo, and each provider needs an API key. Your own custom sources call whatever API you point them at, with secrets you store in Motions.

Built-in sources and their keys

Open Settings → Source keys. Each provider shows where its key comes from:

Shown as	Means
Fixtures	The tenant is in fixture mode. Calls are answered from your recorded fixtures, cost nothing, and use no key.
No key	The provider is open, like domain registration lookups. Nothing to store.
Platform key	Calls use Pruma’s key for that provider.
Tenant key	Calls use the key you stored for this tenant.
Not set	There’s no key at all. Calls that need one fail.

To use your own key, choose the provider, paste the key under Key for <provider>, and choose Save key. Only owners and admins can set or remove keys. A key is stored encrypted and never shown again. Removing it makes calls fall back to the platform key, or fail if there isn’t one.

These are the built-in operations, what one call costs with a key, and how long an answer is reused:

Operation	What it does	Price	Key	Cached for
`rdap.lookup`	Who registered a domain, and when	Free	none	7 d
`cnpj.match`	Match a Brazilian company from a name or CNPJ	$0.002 per call	bull	30 d
`cnpj.company`	Look up a Brazilian company by CNPJ	$0.002 per call	bull	7 d
`cnpj.search`	Search Brazilian companies by name	$0.002 per call	bull	1 d
`exa.search`	Search the web	$0.006–$0.015 per search, by result count	exa	1 d
`typesafe.ask`	Ask Typesafe for a structured judgment	$0.042 per million input tokens	typesafe	30 d
`llm.complete`	Complete a prompt with Claude	From $0.10 per million input tokens	anthropic	30 d
`harvestapi.lead_search`	Search LinkedIn for leads	$0.10 per page	harvestapi	7 d
`harvestapi.profile`	Read a LinkedIn profile	$0.004 per profile	harvestapi	14 d
`fullenrich.enrich_bulk`	Start finding contacts' emails and phones	$0.055 per credit, settled when the result is read	fullenrich	90 d
`fullenrich.enrich_bulk_get`	Read an enrichment's result	Free to poll; the credits used are charged here	fullenrich	90 d
`apollo.people_match`	Match a person to their work email and title	$0.026 per match, free on a miss	apollo	30 d

A step can only call the operations listed under its sources in motion.yaml. See Use sources.

What it costs

Every call is metered. Sources in the app shows, per tenant, the calls made, how many came from the cache, how many failed, and the spend as each provider reported it.

Answers are cached. The same call with the same request, within the cache time above, is answered without calling the provider, and costs nothing. Public data, such as company registries and web searches, is shared across tenants; anything else stays within yours.
Caps stop runaway spend. cap in motion.yaml sets a maximum in US dollars per company and per batch. A company that reaches it is parked, with “budget” as the reason, until someone raises the cap and retries it. See motion.yaml.
Fixture mode costs nothing. While sources: { fixtures: true } is on in tenant.yaml, built-in calls never reach a provider.

Secrets for custom sources

A custom source refers to a secret by name, as {{secrets.HUBSPOT_SANDBOX}} in its request. The value lives in Motions, never in the repository.

Push the source. If it uses a secret that has no value, Settings → Secrets lists it under Missing secrets: calls that use it fail until it’s set.
Choose Set value, paste the value, and choose Save secret. Approvers, admins and owners can set secrets; nobody can read them back.

Names are capitals, digits and underscores, starting with a letter. A new value takes effect on the next call.

Motions is built by Pruma. These docs describe what the platform does today; Limitations lists what it doesn't do yet. Open the app