If the agent connects to an external service, store API keys, tokens, and passwords in Settings → Secrets. Reference them as
x_secrets.NAME; never place credential values directly in the prompt or agent configuration.