> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asteroid.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials & 2FA

> How Asteroid stores credentials and two-factor secrets, and uses them without exposing the value.

A workflow signs in to a target system using credentials stored on its [agent profile](/concepts/profiles).

Store each credential in the profile's **vault**, as a name and a value. Asteroid encrypts every value at
rest, and decrypts it only at the moment a workflow uses it.

The platform mirrors each vault name into a placeholder token, `##CREDENTIAL_NAME##`, uppercased with
underscores. Reference the placeholder in node instructions or a browser automation script. The runtime
replaces it with the real value at the tool boundary, so the value never passes through the model. In a
script, the runtime injects the decrypted value into browser inputs only, never into shell or file tools.
This is separate from the `args` a scripted node receives, which come from the node's declared inputs. See
[Nodes](/concepts/nodes).

<Warning>
  Never paste a real secret into instructions or scripts as plain text. Use a vault placeholder.
</Warning>

See [Security](/support-security/security) for how Asteroid encrypts and protects stored values.

## Two-factor codes

A profile can hold a TOTP secret, so the workflow generates its own authenticator codes. Asteroid supports
every standard TOTP provider, including Google Authenticator, Microsoft Authenticator, Authy and 1Password.

<Steps>
  <Step title="Get the TOTP secret key">
    Ask the target service for the manual setup key rather than the QR code. Most sites offer it behind a
    **Can't scan it?**, **manual entry** or **setup key** link.

    The key is a Base32 string of 16–32 characters.
  </Step>

  <Step title="Store it in the vault">
    Create a credential on the profile and paste the key as the value.

    The credential name must start with `TOTP_` or `2FA_`. The rest of the name is yours to choose.
  </Step>

  <Step title="Reference it">
    Your agent now knows how to generate 2FA codes using the given TOTP secret.
  </Step>
</Steps>

Codes expire on the target service's period, 30 seconds by default. Some services use a different period, so
tell the workflow to generate a code immediately before it submits.

For codes that arrive by email instead, see [Workflow emails](/concepts/emails).

<Tip>
  Some 2FA setups are more complex than a standard TOTP secret. [Get in touch](https://asteroid.ai/demo) and
  we can help you set it up.
</Tip>

See [Agent profiles](/concepts/profiles) for how to add and manage credentials.