Coeus needs no API keys
Why Coeus asks for no key, and how a source behind a login is opened instead.
There is nowhere to put a key, because Coeus never wants one. It asks for no API key, stores none and sends none — not to a source and not to this website. If an older version of Coeus kept keys for you, they were removed from this browser when you upgraded, and nothing kept a copy.
Where the destinations come from instead
Built-in and custom sources are destinations with URL templates for the indicator types they support. You choose a source from the indicator view or explicitly open the enabled matches in a tab group. Local tools work without contacting those destinations.
Sources behind a login: open it yourself
Some services will only answer a signed-in account. Coeus does not sign in on your behalf and does not hold a credential that could. It does the one honest thing available: it opens the source in your own browser, in the session you are already signed into, with the indicator already filled in. You see what your account is entitled to see, on that service's own page, under your own terms with them.
Sources that require their own account can be marked accordingly in Sources. You still decide whether to open them.
What this means for privacy
The strongest privacy claim a tool can make about a secret is that it never has one. There is no key in local storage, none in Chrome sync storage and none in an export — because there is no key. Privacy design sets out the rest of the argument, and /privacy is the policy.