Skip to main content
A Secret is a key, token or password you give Worksong so an Agent can use it for an allowed site. The Agent never sees the value. It sees a handle, and each use goes through a separate service that holds the value and decides.

​
What you control

  • Which sites a Secret may be sent to, and how it is attached (for example as a bearer token).
  • An end date (up to five years). After it, the Secret behaves as deleted for Agents.
  • Every use needs your tap. For reads you can allow for the day or for 30 days, per Agent and site. A write is allowed one call at a time.
  • You can rotate the value, delete the Secret (grants are revoked) and read an activity list of requests and uses.
Only the workspace owner can manage Secrets.

​
Signing in to a website

An Agent can sign in to a website with a password you saved as a Secret. It asks first, and the card offers only Allow once: each sign-in needs your tap. The password is typed into the page for the Agent; the Agent never sees it. Source: worksong-ai/worksong:docs/API.md@e5e65e9, worksong-ai/worksong:CLAUDE.md@e5e65e9, worksong-ai/worksong:infra/k8s/components/worksong-app-config/kustomization.yaml@19703ec, worksong-ai/worksong:scripts/e2e-areas.json@19703ec. Docs version: Worksong 2.0 with Work 1.2.