Control and security
Your bots sign in for you, and never see the password
Saved logins and secrets let Brainwrite bots sign in to websites and call APIs without ever holding a password or token. Save a login once, or connect a 1Password vault, and Brainwrite itself types it into that site's login page, 2FA code included. A secret is added to a request only when it is sent, and only to the one site you allow.
On the first of each month, download last month's payout report from the partner portal and file it in Finance.
Your Chief of Staff put a team on it
Nova· Chief of Staff
Penny· Reports bot
Atlas· Matching bot
- Signed in to partners.example.com with your saved login and its 2FA code.
- Downloaded payouts-2026-10.csv (214 rows).
- Filed it in Finance/Payouts and added the total to the month-end sheet.
- The password never reached me: Brainwrite typed it.
DoneDone. Nothing was sent.
The monthly report behind a login: done. Nothing sent.
- 1Signed in to partners.example.com with your saved login and its 2FA code.
- 2Downloaded payouts-2026-10.csv (214 rows).
- 3Filed it in Finance/Payouts and added the total to the month-end sheet.
3 bots on this jobSee it in the app
Saved logins and secrets in Brainwrite.
Get the October payout report from the partner portal.
Sign in in Scout’s built-in browser. Open takes you to its Browser tab, already in your control.
You type the password into the page yourself. Brainwrite never sees it. Cancel Open Save a login DoneFrom now on Scout signs in with it without you, and never sees the password. Change or delete it in Settings → Logins.
Username or email[email protected]Password••••••••••2FA setup key (optional) Encrypted on the computer Brainwrite runs on and never shown again. Brainwrite types it into the login page for the bot.CancelSave and continueQuill needs it to post release notes. Sent only to
https://hub.example.comNot nowSave securelyAn illustration. Bots never see a password or a token: Brainwrite types or sends them itself, only to their own site.
Why it matters
On your own, with a chatbot, and with Brainwrite.
| Topic | Doing it yourself | A single chatbot | Brainwrite |
|---|---|---|---|
| Signing in | Every time, by hand | Pastes your password into the chat | Brainwrite types a saved login; the bot never sees it |
| 2FA | Find your phone | Can't | Makes the code from a saved setup key |
| API tokens | Pasted into scripts and notes | Kept in the conversation | Sent only to one https site, scrubbed from replies |
How it works
How Saved logins and secrets works.
- 01
A bot asks with a card
When a bot needs a site it can't reach, it shows a Sign in needed card naming the site and its reason. Bots never ask for a password or a code in chat.
- 02
Sign in, or save a login
Open takes you to the bot's browser, already in your control; Done hands it back. Or choose Save a login and enter the username, password and an optional 2FA setup key.
- 03
The bot signs in by itself
Next time, the bot asks Brainwrite to fill the login. Brainwrite types the values into that site's page and submits; the bot hears only whether it worked.
- 04
Tokens work the same way
A Secret needed card asks for an API token and the one https site it may go to. The bot names the secret; Brainwrite adds the value only when it sends the request.
Good to know
The details.
One-time codes
Save the site's 2FA setup key and Brainwrite makes the one-time code as the form is filled. A bot can also read a code sent to your connected inbox to finish a sign-in you asked for.
Logins from 1Password
Connect a 1Password service account that can read one vault, and its logins appear as From 1Password. Each vault is for every bot until you pick bots for it.
Only on its own site
A login fills only on https pages of its own site, such as accounts.example.com for example.com. Tick Only on this exact address for a company that shares its domain.
Secrets in one place
Settings → Secrets lists each secret's site, which bots may use it, how it is sent and when it was last used. Each says what it may be used for: requests, MCP servers or commands.
Encrypted where your bots run
Logins are encrypted (AES-256-GCM) on the computer Brainwrite runs on. Secrets live in your computer's secure store, or encrypted on My Cloud. Neither is shown again.
Browser profiles that keep you signed in
Each bot browses in its own Chrome profile, and its sign-ins survive closing the browser. See and sign out of sites in Browser profiles, or use My Chrome for picky sites.
The edges, plainly
- Saved logins fill in the built-in browser and My Chrome. On a private desktop, a Cloud desktop or a VPS, the bot asks you to sign in instead.
- A CAPTCHA, a passkey or payment details still need you.
- Saved logins stay on the computer they were saved on; they are not part of backups, team exports or a move to Cloud.
- Secrets are not yet available on a server you run yourself, or from the phone apps.
Works with
Apps it's often used with.
Stripe
Look up Stripe customers and payments, prepare invoices and refunds for approval, and summarise revenue every week.
QuickBooks
Pull QuickBooks reports, chase receivables, and draft invoices, estimates, and bills for a person to approve.
GitHub
Triage GitHub issues, review pull requests, read failing workflow logs, and draft release notes. Merges wait for you.
FAQ
Questions about Saved logins and secrets
How can an AI agent log in to a website without my password?
In Brainwrite, save the login once, from a bot's Sign in needed card or Settings → Logins. When the bot reaches that site's login page, it asks Brainwrite to fill it, and Brainwrite types the username, password and any 2FA code into the page itself. The bot is told only whether the sign-in worked.
Can Brainwrite use my 1Password logins?
Yes. In Settings → Logins choose Connect 1Password and paste a service account token that can read one vault, such as Shared with Brainwrite. Its logins appear as From 1Password and fill the same way as saved logins. 1Password decides which vaults the token reaches.
What is the difference between a saved login and a secret?
A saved login is a website's username and password, typed into its login page. A secret is a token, such as an API key, that a bot's request or skill needs. Brainwrite adds a secret to the request only when it sends it, and only to the one site you set.
Do bots ever see my passwords or tokens?
No. A saved password is never shown again by any screen or API, and the bot only names the login or secret. If you paste a token into the chat anyway, the bot won't use it: it tells you to rotate it and asks again with the secure card.
Works well with
Related features.
Secrets
Bots use API tokens by name. The value goes only to one https site and never reaches the chat.
Built-in browser
A browser tab bots use for web work, which you can watch and take over for sign-ins and MFA.
Approvals
Risky actions become cards you approve or deny in the conversation. Ask or Full Access per thread.
Connected apps
Gmail, GitHub, Slack, Notion and hundreds more via OAuth, with per-bot tool grants.
Give your first job to Brainwrite.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing.
macOS today. Windows and Linux are coming soon.