# Library third-party API settings

Source: https://govform.com/resources/documentation/article/20-07-library-third-party-api-settings
Topic: Library Settings

Library integration defaults hold protected credentials for supported mapping and notification services. They are separate from Govform API keys, which authorise external systems to call Govform.

## Find the integration settings

Open **Library settings → Integrations & data → Ordnance Survey** or **GOV.UK Notify** where available. Older navigation may group these as **Third party APIs**. General Connectors and managed sign-in connections use their own [Connections](<https://govform.com/resources/documentation/article/20-16-library-connections>) settings.

| Setting | Stored property | Use |
| --- | --- | --- |
| Ordnance Survey API key | `gfsecretOsApiKey` | Authenticates supported Ordnance Survey map/address services. |
| Ordnance Survey API secret | `gfsecretOsApiSecret` | The matching secret where required by the selected provider product. |
| GOV.UK Notify API key | `gfsecretGovNotifyApiKey` | Authenticates notification/sign-in templates for the configured Notify service. |

Check service-level overrides before rotating a library default. A template ID belongs in the action or sign-in setting that uses it; it is not the API credential.

## Apply to QA and Production

The current Ordnance Survey and GOV.UK Notify pages each have one **Save** with a confirmation for all available environments, including Production. They publish independently. A successful save queues delivery; check acknowledgements before testing.

Test a replacement account or key through an appropriate service-level override or controlled test before changing a shared live default. Do not treat Save as a QA-only operation. Applying these defaults is separate from deploying a service version.

## Rotate or clear a key

Record dependent services, provider account and permissions. Replace the masked value through the settings control, confirm its live impact, then verify delivery and a controlled request. Revoke an old credential at the provider only after dependent services have moved. Clearing the saved value does not revoke it there.

## Troubleshoot

Check the environment status, service override, provider permission and deployed service version. User view mocks do not prove that a map search, notification or sign-in email reaches the real provider. Keep credentials out of content, diagnostic output and support messages.

See [Shared settings publication](<https://govform.com/resources/documentation/article/20-15-library-settings-publication>), [Notify email actions](<https://govform.com/resources/documentation/article/25-05-action-gov-notify-email>) and [Govform API key settings](<https://govform.com/resources/documentation/article/30-govforms-api-key-settings>).