> ## Documentation Index
> Fetch the complete documentation index at: https://tbd-6fc993ce-mason-add-copy-page-to-context-menu.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

To launch a web automation or web agent that authenticates on behalf of users, there are multiple ways to pass the credentials on the Kernel app platform:

## 1. Deployment environment variables

Deploy your app with the credentials as [environment variables](/apps/deploy#environment-variables). Then, your invocation can use them at runtime.

<CodeGroup>
  ```typescript Typescript/Javascript theme={null}
  app.action("authenticated-action", async (ctx: KernelContext) => {
      const username = process.env.USERNAME;
      const password = process.env.PASSWORD;
      if (!loggedIn()){ // Check for whether the user is already logged in on the website
          login(username, password)
      }
      // Rest of your browser automation logic
  });
  ```

  ```python Python theme={null}
  @app.action("authenticated-action")
  async def authenticated_action(ctx: kernel.KernelContext):
      username = os.environ.get("USERNAME")
      password = os.environ.get("PASSWORD")
      if not loggedIn(): # Check for whether the user is already logged in on the website
          login(username, password)
      # Rest of your browser automation logic
  ```
</CodeGroup>

## 2. Runtime variables

For use cases that login on behalf of many users (such as platforms acting on behalf of end users), pass the credentials at runtime using the [payload parameter](/apps/invoke#payload-parameter).

Make sure to use encryption standards in your app to protect the credentials.

<CodeGroup>
  ```typescript Typescript/Javascript theme={null}
  app.action("authenticated-action", async (ctx: KernelContext, payload: { encryptedUserName: string, encryptedPassword: string }) => {
      if (!loggedIn()){ // Check for whether the user is already logged in on the website
          username = decrypt(encryptedUserName);
          password = decrypt(encryptedPassword);
          login(username, password)
      }
      // Rest of your browser automation logic
  });
  ```

  ```python Python theme={null}
  @app.action("authenticated-action")
  async def authenticated_action(ctx: kernel.KernelContext, payload: { encryptedUserName: str, encryptedPassword: str }):
      if not loggedIn(): # Check for whether the user is already logged in on the website
          username = decrypt(payload.get("encryptedUserName"));
          password = decrypt(payload.get("encryptedPassword"));
          login(username, password)
      # Rest of your browser automation logic
  ```
</CodeGroup>