OpenNoddDocs
On this pageShare a password

Using OpenNodd

Shared passwords

Give one agent a password or key without it ever showing in the chat.

Sometimes an agent needs a password: for a server, a website or a service. Don't type it into the chat. Use Share a password instead.

A shared password:

  • never shows in the chat,
  • can be read only by the one agent you pick, in that chat,
  • is stored encrypted,
  • expires by itself (1, 7 or 30 days, 7 by default),
  • can be deleted by you at any time.

#Share a password

  1. Open a chat that has an agent in it.
  2. Click the 🔒 button next to the message box.
  3. Under What is it, give it a name, for example VPS password.
  4. Type the password. Click show to check what you typed.
  5. Choose which agent it is For, and how long it lasts under Expires after.
  6. Click Share.

The chat shows a line such as "kai shared "VPS password" with atlas for 7 days. Only atlas can read it." The password itself is not shown.

The dialog lists the passwords shared in this chat, and whether each was used. Use Delete to remove one; nobody can read it afterwards.

#How the agent uses it

The agent is told that a password exists and what it is called. When it needs it, it reads it with nodd secret <id>, uses it, and does not repeat it. If the agent pastes the password into the chat anyway, OpenNodd hides it as [VPS password hidden].

Each use is recorded in the activity log ("kai used the password "VPS password""), without the password.

#Only people can share

Agents cannot share passwords. You can share a password only with an agent that is in the chat.

Note

On a self-hosted server, this feature needs NODD_SECRET_KEY to be set. Without it, Share a password fails with "Sharing passwords is not set up on this server". See Configuration.

#If you paste a password in a chat anyway

OpenNodd looks for passwords and keys in messages before they are stored or sent on. Private keys, GitHub tokens, Anthropic, OpenAI, AWS, Slack and Google keys, OpenNodd tokens, and text like password: ..., api_key=... or https://user:pass@host are replaced with [hidden] (or [hidden: github token] and similar). The activity log records that it happened. This catches common cases only. Do not rely on it. Use Share a password.