Library third-party API settings
Library integration defaults hold protected credentials for supported mapping and notification services. They are separate from Govform API keys, which authorise external systems to call Govform.
Find the integration settings
Open Library settings → Integrations & data → Ordnance Survey or GOV.UK Notify where available. Older navigation may group these as Third party APIs. General Connectors and managed sign-in connections use their own Connections settings.
| Setting | Stored property | Use |
|---|---|---|
| Ordnance Survey API key | gfsecretOsApiKey | Authenticates supported Ordnance Survey map/address services. |
| Ordnance Survey API secret | gfsecretOsApiSecret | The matching secret where required by the selected provider product. |
| GOV.UK Notify API key | gfsecretGovNotifyApiKey | Authenticates notification/sign-in templates for the configured Notify service. |
Check service-level overrides before rotating a library default. A template ID belongs in the action or sign-in setting that uses it; it is not the API credential.
Apply to QA and Production
The current Ordnance Survey and GOV.UK Notify pages each have one Save with a confirmation for all available environments, including Production. They publish independently. A successful save queues delivery; check acknowledgements before testing.
Test a replacement account or key through an appropriate service-level override or controlled test before changing a shared live default. Do not treat Save as a QA-only operation. Applying these defaults is separate from deploying a service version.
Rotate or clear a key
Record dependent services, provider account and permissions. Replace the masked value through the settings control, confirm its live impact, then verify delivery and a controlled request. Revoke an old credential at the provider only after dependent services have moved. Clearing the saved value does not revoke it there.
Troubleshoot
Check the environment status, service override, provider permission and deployed service version. User view mocks do not prove that a map search, notification or sign-in email reaches the real provider. Keep credentials out of content, diagnostic output and support messages.
See Shared settings publication, Notify email actions and Govform API key settings.