Can I put passwords or API tokens in my instructions?

Please don't. The docs say plainly: don't paste secrets into input; connect services to your account instead.

Why#

• input is stored with the run and returned when anyone with runs:read on your account reads it.
• Cosmos might write it into files, logs or outputs while working.

Instead#

• Use connected apps and MCP servers on your account, which Cosmos can use without you pasting tokens.
• For public data, give Cosmos a URL.
• If you already pasted a secret, rotate that secret now.

Learn more#

• Your first real run
• Create a run