Skip to main content
A credential is a stored secret bound to the agents allowed to use it, delivered to a run without its value being exposed. This page explains the path a secret takes, the places it deliberately never goes, and what rotation and revocation actually do.

​
The shape of the guarantee

Three properties, and they are what the rest of this page is about:
  • A value is delivered for the run that needs it, not held ambiently by an agent.
  • A raw value never passes through your browser or a deployment, so it is not sitting in a console screenshot, a manifest, or a build log.
  • A binding, not a workspace membership, grants access. Being an agent in the workspace does not give you the workspace’s secrets.

​
The path a secret takes

1

You store it

The value goes into the credential store. Once stored, it is not readable back out through the console — the screen manages the credential, not its contents.
2

You bind it

A credential is bound to the agents allowed to use it. An agent with no binding to a credential cannot request it, whatever else it can do.
3

It is delivered to a run

When a bound agent starts a run that needs the credential, the value is delivered to the worker for that run.
4

The run ends and it is gone

The SDK holds a run’s credentials in memory for the run only and never persists them, so a worker restart or a crash does not leave a secret on disk.

​
What is masked on the way out

Any run-scoped secret is replaced with a redaction marker before anything leaves the worker — recursively, across event names, content, payloads, and metadata. A token echoed into a log line or returned inside a tool result does not reach the run record in the clear.
This is a platform behavior, not a rule you configure. Configurable redaction — keeping a value out of a specific tool call or model prompt — is a guardrail, and it applies to values that are not run-scoped secrets.

​
Rotation and revocation

Every one of these is recorded in the audit log: creation, updates, value replacement, deletion, and binding changes.

​
Practical guidance

Bind narrowly and rotate freely. The point of per-agent binding plus next-run rotation is that scoping a credential tightly costs you nothing operationally — the agent that only reads gets a read-only credential, and rotating it does not involve the agent’s deployment at all.
Keep a worker’s token out of source control: deliver it as an environment variable or a mounted secret, and rotate it from the console rather than editing it in place.

​
Next steps

Credentials & secrets

Creating and binding a credential.

Data handling & redaction

What else is masked, and what is not.

Agent identity

The worker token, and how it is managed.

Audit log

The record of every credential change.