# Credential safety

> A worker never holds a password or a key. The credential is added to the request on the way out, by a part of Ergoly the worker cannot reach.

Ergoly Docs › Work. Web: https://www.ergoly.ai/docs/work/connections/credential-safety · Index: https://www.ergoly.ai/docs/llms.txt

When a worker uses a connected app, it never sees the key or the token. It makes the call, and a gateway between the worker and the internet matches the request against the connections placed within that worker's reach, adds the credential, and sends it on. The credential exists in Ergoly's vault and on the wire to the vendor, and nowhere in between.

- No screen in control, and no answer from the API, ever shows a stored key. **Reconnect** replaces it; nothing reveals it.
- A sign-in that needs consent needs a person. The worker posts a link to open; nothing exists until the consent finishes.
- A key pasted in Slack goes into the vault and is never repeated in the thread.
- A connection placed with Acme is never added to a request from Globex's copy, because the gateway checks placement before it adds anything.

Why it is built this way: a worker is a program that reads messages from people outside your agency. If it held a key, a clever message could ask it to repeat the key. It cannot repeat what it does not have.

- [How credentials are held](https://www.ergoly.ai/docs/technical/how-credentials-are-held): The vault and the gateway, in detail.