Credentials and reveal links#

Credentials for provisioned accounts are encrypted at rest and scoped to one agent. You can read them; a reveal link is how.

Who can see what#

	Owner	Agent
Account address or handle	Yes	Yes
Stored password for an account it owns	Yes, through a reveal link	Yes, for its own use
Wallet private key	No	No
Another agent's credentials	No	No

Reveal links#

A reveal link is a one-time owner URL that shows a stored login. It is built to be safe to open: single use, short-lived, and usable in a private window so it does not collide with a session you are already signed into.

The agent can create one on request — that is how it hands you a login without putting the password into a chat transcript.

When you need one#

• Signing in yourself to check something.
• Moving an account somewhere else.
• Before you remove an agent, if you want to keep an account it created.

Handling them well#

Treat a reveal link like the password it shows. Open it, use it, let it expire. Do not forward it — a one-time link that someone else opens first is a one-time link you have lost.

Wallets are excluded, deliberately#

The reveal path covers reusable provisioned-account credentials. Wallet keys are not part of it and are never returned by any path. See Crypto wallets.