Blues published a walkthrough of keeping API keys off the device using Notehub proxy routes, and the mechanism is worth stating precisely because the security property falls out of it rather than being asserted. The firmware calls web.get, web.post or web.put against a route alias and nothing else. Notehub holds the credential as an encrypted Project Secret, substitutes it into the route’s headers through a [$$SECRET_NAME] placeholder at the moment the route fires, makes the HTTPS call itself, and hands back the response. “From the third-party API’s perspective it’s being called by Notehub. From the device’s perspective it made a web request.” The key is never in the firmware image, which means it is never in the 4,000 units already in the field, and never on the $20 programmer someone can buy to read one back.
The claim underneath is narrower than “this is secure” and better for being narrow: “Secrets values are encrypted at rest, decrypted in-memory only at the instant a route fires, and are never returned by the Notehub API.” That last clause is the one that matters operationally — a secret store you can read back through the same API that stores it has not moved the problem, it has relocated it. Rotation follows for free: one change in Notehub covers every device, with no firmware update. The second half of the post is a different argument wearing the same clothes: inbound JSONata transforms shrink a 385-byte response to 56 before it crosses the cellular link, because “paying cellular data to move a rate_limit object to a microcontroller, and then spending that microcontroller’s RAM parsing it, is a bad trade.” Response shaping as a cost decision is a constraint most API providers never have to reason about.
The catalog’s Blues record carries 14 API pages, and the post is a tour of four of them. The Blues route API is the proxy route itself, the Blues project API is where the secrets store lives, the Notecard API is the web.* request surface on the device side, and the Blues event API is what the traffic becomes once it lands. Its agentic access profile reads 128 operations with 62 acting and 2 marked human-in-the-loop — a genuinely large write surface for a company this size,.
Blues scores 51.0, developing on the Kin Score, strongest on contract quality at 63.3 and operational transparency at 65.8. Agent Readiness is 32.7, agent-ready, and here the catalog largely agrees with the post rather than arguing with it: auth_clarity is lit, reversibility_documented is lit, and dry_run_mode is lit — the last of which almost nothing in the catalog can claim. A company whose product is credential handling has its credential handling legible in the contract. The mismatch is smaller and fixable: event_surface_described reads unlit for a provider shipping both an event API and a webhook API, which is a pointer problem rather than a product one. idempotency is unlit across 62 acting operations, on devices whose defining characteristic is an unreliable link and a retry.