Skip to main content
Computer Agents can work across customer systems, but each connection should use the narrowest supported credential flow. Keep secrets separate from instructions, Tasks, helper arguments, and workspace files.

​
Choose the correct connection

Do not paste credentials into chat and ask the Agent to remember them.

​
Keep credentials at the right scope

Use an Agent-level secret for a helper or skill that belongs to one Agent. An organization-level value can be an inherited fallback when several authorized Agents intentionally share the same credential. Channel connections are Agent-specific. Verify the connection from the exact Agent that will use it, especially when several Agents use the same Computer.

​
Complete interactive sign-in safely

When a person must authenticate in the Browser:
  1. create a temporary Browser access link
  2. confirm the selected Agent before signing in
  3. complete authentication without sharing the password in chat
  4. close the access session
  5. test the intended skill, channel, or browser workflow
Do not send a long-lived Browser or private Canvas link to an unintended recipient.

​
Use secrets in reusable helpers

Helpers should declare the secret identifiers they require and accept only business inputs when called. The helper reads the credential through the managed runtime; callers should never pass the secret value as an argument. After changing a helper secret, refresh and validate the helper registry and run a safe representative test.

​
Rotate or remove access

Before deleting or replacing a credential, identify the skills, helpers, Tasks, and channels that depend on it. Add the replacement, verify the capability, then remove the old credential. Periodically remove unused credentials and browser sessions. Review destination-system audit logs when available. See Skills, accounts, and credentials and Reusable helpers and browser automation.