> ## Documentation Index > Fetch the complete documentation index at: https://docs.worksong.ai/llms.txt > Use this file to discover all available pages before exploring further. # Secrets > Keys and passwords Agents can use but never read. A Secret is a key, token or password you give Worksong so an Agent can use it for an allowed site. **The Agent never sees the value.** It sees a handle, and each use goes through a separate service that holds the value and decides. ## What you control * Which sites a Secret may be sent to, and how it is attached (for example as a bearer token). * An end date (up to five years). After it, the Secret behaves as deleted for Agents. * Every use needs your tap. For reads you can allow for the day or for 30 days, per Agent and site. A write is allowed one call at a time. * You can rotate the value, delete the Secret (grants are revoked) and read an activity list of requests and uses. Only the workspace owner can manage Secrets. ## Signing in to a website An Agent can sign in to a website with a password you saved as a Secret. It asks first, and the card offers only **Allow once**: each sign-in needs your tap. The password is typed into the page for the Agent; the Agent never sees it. Source: `worksong-ai/worksong:docs/API.md@e5e65e9`, `worksong-ai/worksong:CLAUDE.md@e5e65e9`, `worksong-ai/worksong:infra/k8s/components/worksong-app-config/kustomization.yaml@19703ec`, `worksong-ai/worksong:scripts/e2e-areas.json@19703ec`. Docs version: Worksong 2.0 with Work 1.2. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.