> ## Documentation Index
> Fetch the complete documentation index at: https://tbd-6fc993ce-cj-profile-state.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

To launch a web automation or web agent that authenticates on behalf of users, there are multiple ways to pass the credentials on the Kernel app platform:

## 1. Deployment environment variables

Deploy your app with the credentials as [environment variables](/apps/deploy#environment-variables). Then, your invocation can use them at runtime.

<CodeGroup>
  ```typescript Typescript/Javascript theme={null}
  app.action('authenticated-action', async (ctx: KernelContext) => {
    const username = process.env.USERNAME;
    const password = process.env.PASSWORD;
    if (!loggedIn()) {
      login(username, password);
    }
  });
  ```

  ```python Python theme={null}
  import os

  @app.action("authenticated-action")
  async def authenticated_action(ctx: KernelContext):
      username = os.environ.get("USERNAME")
      password = os.environ.get("PASSWORD")
      if not logged_in():
          login(username, password)
  ```
</CodeGroup>

## 2. Runtime variables

For use cases that login on behalf of many users (such as platforms acting on behalf of end users), pass the credentials at runtime using the [payload parameter](/apps/invoke#payload-parameter).

Make sure to use encryption standards in your app to protect the credentials.

<CodeGroup>
  ```typescript Typescript/Javascript theme={null}
  app.action('authenticated-action', async (ctx: KernelContext, payload) => {
    if (!loggedIn()) {
      const username = decrypt(payload.encryptedUserName);
      const password = decrypt(payload.encryptedPassword);
      login(username, password);
    }
  });
  ```

  ```python Python theme={null}
  @app.action("authenticated-action")
  async def authenticated_action(ctx: KernelContext, payload):
      if not logged_in():
          username = decrypt(payload["encryptedUserName"])
          password = decrypt(payload["encryptedPassword"])
          login(username, password)
  ```
</CodeGroup>