How Google Sheets Add-ons Store API Keys Securely (PropertiesService Explained)

When you paste an API key into a Google Sheets add-on, the most common question that follows is: where does that key actually go? Is it stored in the sheet somewhere? Can someone else with access to my spreadsheet see it? Does the add-on developer have access to it?

These are reasonable questions. Here’s the accurate answer for how add-ons like the LinkedIn Enricher handle API key storage.

---

What PropertiesService Is

Google Apps Script — the runtime that powers Google Sheets add-ons — includes a built-in key-value storage system called PropertiesService. It’s not part of the spreadsheet itself. It’s a separate, sandboxed storage layer provided by Google specifically for this purpose.

PropertiesService has three scopes:

Scope	What it stores	Who can access it
ScriptProperties	Properties for the entire script project	Everyone who has access to the script
UserProperties	Properties scoped to the current Google user	Only the authenticated user — not other users of the same sheet
DocumentProperties	Properties for the specific document	Anyone with access to the document

For API keys, the correct scope is UserProperties. This means the key is stored in Google’s infrastructure, tied to your Google account, and not accessible to other users — even if they share the same spreadsheet.

---

Why UserProperties Is Safer Than Storing Keys in the Sheet

If API keys were stored in a sheet cell, several things could go wrong:

• Any viewer with read access to the sheet could see the key
• The key would appear in CSV exports, Google Drive backups, and accidental screenshares
• If the sheet is duplicated or shared by a collaborator, the key travels with it

UserProperties avoids all of these:

Risk	Sheet cell	UserProperties
Visible to sheet viewers	Yes	No
Included in CSV export	Yes	No
Shared when sheet is duplicated	Yes	No
Travels with sheet link	Yes	No
Accessible by add-on developer	Potentially	No
Scoped to your Google account	No	Yes

---

How the LinkedIn Enricher Uses It

When you enter your Datagma or LeadMagic API key in the Settings tab and save:

// What the add-on does when you save your API key
const userProperties = PropertiesService.getUserProperties();
userProperties.setProperty('DATAGMA_API_KEY', apiKey);

When enrichment runs and the add-on needs to call the provider API:

// Retrieving the key at enrichment time
const userProperties = PropertiesService.getUserProperties();
const apiKey = userProperties.getProperty('DATAGMA_API_KEY');

// Making the API call directly from your Google account
const response = UrlFetchApp.fetch(
  `https://api.datagma.com/api/ingress?apiId=${apiKey}&data=${linkedinUrl}`
);

The key is retrieved from storage and used immediately in an API call. It is never sent to Makeinfo’s servers or any intermediate service. The call goes directly from your Google account (via Apps Script’s UrlFetchApp) to the provider’s API endpoint.

---

The Data Call Path

This is the full call path when enrichment runs:

Your Google Sheet → Apps Script runtime (running in your Google account)
  → Datagma API (or LeadMagic API)
  → Response returned to Apps Script
  → Results written back to your Google Sheet

Makeinfo is not in this call path. The add-on code runs in your Google account’s Apps Script environment. The API credentials and the contact data never pass through Makeinfo’s infrastructure.

This is a structural property of how Google Workspace Add-ons work — not a policy claim. The architecture enforces it.

---

What PropertiesService Does Not Protect Against

Being accurate about the limits matters:

A compromised Google account. If someone gains access to your Google account, they can access anything your account has access to — including properties stored via PropertiesService. This is the same risk as any credential stored in any Google product (Drive, Password Manager, etc.).

Malicious add-ons. Not all add-ons use UserProperties correctly. An add-on could, in principle, read a key you stored and send it to an external server. This is why you should only install add-ons from trusted sources and review the permissions they request during installation.

The OAuth permissions screen. When installing any Sheets add-on, Google shows a permissions screen listing what the add-on is allowed to do. Review this before approving. The LinkedIn Enricher requests permission to access the current spreadsheet and make external network requests — these are the minimum permissions required for enrichment to function.

---

How to Verify Add-On Permissions

After installing any Google Sheets add-on, you can review and revoke its permissions at any time:

1. Go to your Google Account: myaccount.google.com
2. Navigate to Security → Third-party apps with account access
3. Find the add-on by name
4. Click to see what it has access to, or revoke access

For the LinkedIn Enricher, you’ll see something like:

• “See, edit, create, and delete all your Google Sheets spreadsheets” (required to write enrichment results back to the sheet)
• “Connect to an external service” (required to call Datagma and LeadMagic APIs)

These are standard permissions for any enrichment add-on. If an add-on requests access to your Gmail, Drive files unrelated to Sheets, or contacts — that’s worth scrutinizing.

---

A Note on API Key Rotation

If you rotate your Datagma or LeadMagic API key (because a key was exposed or as routine security hygiene), you need to re-enter the new key in the add-on Settings tab. The new key overwrites the previous stored property.

Rotating your provider API key does not affect the add-on itself — it just updates the credential used for subsequent API calls. Old enrichment results in the sheet are unaffected.

---

Your API keys stay in your Google account. LinkedIn Profile Enricher for Google Sheets →