如何讓 Agent 代你登入而不讓模型看到密碼

You are halfway through a task with an agent. It has found the settings page and filled in most of the form, and then it stops: "To continue, please paste your password here." Or it needs an API key for the service it is about to call, and the chat box is right there.

It feels harmless because the conversation feels private. But a chat is not a safe.

Why the chat box is the wrong place

Anything you type into a prompt becomes part of the model's context. Depending on the tool, it may be kept in history, written to logs, sent to a hosted model or summarized into memory that later conversations read. You cannot see or reliably delete all of those copies.

The same goes for instruction files. Files such as CLAUDE.md or AGENTS.md exist so the model reads them on every run. That makes them a good home for project conventions and a bad home for a token. Treat them as visible to the model, and often to everyone with access to the repository.

The goal is simple to state: the agent can use a credential, but the raw value never enters the text the model reads or writes.

Use a store the tool calls for the model

The pattern that works is a credential store or vault that sits outside the conversation. The model asks for an action, such as "sign in to the billing portal" or "call the API with the deploy token", and the tool fetches the secret and uses it directly. The model sees a reference or a result, never the value.

Your operating system's keychain is the simplest version of this; a dedicated secrets vault adds encryption, access rules and a usage history. Either way, check one thing: when the agent uses the secret, does the value show up in the transcript? If it does, the store is decoration.

Give the agent less than you have

Scope tokens. Create a token for the one job: read-only if reading is enough, one repository, one project. Do not reuse a key that can do everything.
Expire them. A short lifetime turns a leak into a small incident. Set the expiry when you create the token, not later.
Prefer OAuth and app passwords over master passwords. Delegated access can be limited and revoked without changing the password you use everywhere else. A master password should never be something an agent holds.
Keep 2FA and payments in human hands. The second factor is where a person confirms intent. Let the agent get you to that screen; you approve the code, the purchase or the transfer yourself.

Log every use, and read the log

A credential an agent can use should leave a trace each time it is used: which secret, when, and for which task. Many services also keep their own sign-in and API activity pages. Set a recurring reminder to skim both. You are looking for uses you do not recognize, at times you were not working, against services you did not ask about.

After a paste accident, rotate

If a secret did land in a chat, a log or a committed file, assume it is exposed. Rotate it at the source, revoke the old value, then clean up the copies you can find. Deleting the message is fine, but it does not replace rotation.

Risk and the safer habit

Risk	Safer habit
Pasting a password or key into the chat	Keep it in a vault or keychain the tool reads on the model's behalf
Tokens in CLAUDE.md, AGENTS.md or other instruction files	Refer to a named secret; never write the value
One broad key reused for everything	Scoped, per-task tokens with an expiry date
The agent holds your master password	OAuth or app-specific passwords you can revoke
The agent completes 2FA or a payment alone	You confirm the code, purchase or transfer yourself
No record of what the agent did with access	A usage log per secret, reviewed on a schedule
A secret leaked into a transcript	Rotate at the source first, then clean up

Before you let an agent sign in through a browser

Browser sign-in is where agents become most useful for website chores. Before you grant it, check:

[ ] The credential comes from a store, not from the chat or a file the model reads.
[ ] The account has the least access the task needs; a separate, limited account is better where the site allows it.
[ ] 2FA stays on, and the second factor reaches you, not the agent.
[ ] Payments, account deletion and security settings need your confirmation.
[ ] You can see which sites the agent signed in to, and when.
[ ] You know how to revoke the session or token in one step.
[ ] Saved browser sessions are cleared or expire when the task is done.

None of this needs special tooling to start. Move the next secret out of the prompt, shorten the next token's life, and keep the last click on anything irreversible for yourself.

This post comes from the Octuo team at Tutuo, Inc. More of our notes on handing work to agents are on our blog.

Drafted with AI assistance and reviewed before publishing.