Learn the basics

Passwords and programs

A password is a secret you type with your fingers. You use it when a website or app asks you to prove you are you. The service checks what you typed against what it has on file.

A program cannot type the way you do. When software needs to log in or call a service for you, it sends a secret in the background, often as part of each request. You may never see that happen.

That difference matters. You choose when to type your password. A program may send its secret over and over while it runs. If you copy that kind of secret into a chat, you are giving the chat the same repeating power the program had.

API keys

An API key is one common form of that program secret. Services give it to you so trusted software can act on your account without you sitting at the keyboard.

When the program makes a request, it usually includes the key so the service knows the call is allowed. Think of it as a badge the program shows on every trip to the service.

What a stolen key can do depends on what you allowed when you created it. Someone who gets it may read your data, change settings, send messages, or spend money. Some keys are limited. Others are not.

Pasting an API key into a chat gives that chat the same power. The chat provider may store what you typed. The assistant may try to use the key again later. You lose the clean line between one job and a secret that keeps working.

SSH key pairs

An SSH key is two linked pieces, not a password you memorize. You generate them together. You put the public half on the server. The private half stays on your computer or phone.

When you connect, the server checks that your private half matches the public half it already holds. You do not type a password for that check each time.

The public half is meant to be shared with the server. The private half is not. You do not paste the private half into a chat, an email, or a support ticket.

If you paste the private half into a chatbot, the chat may keep a copy. Anyone who can read that conversation, or anything the bot remembered from it, may gain a way into your server as you.

Password managers and one-task handoffs

A password manager stores usernames and passwords so you do not have to remember them. When you visit a site, you or your browser can fill the fields and you press sign in.

That flow is built for you at the keyboard, or for your browser acting as your helper. The manager is keeping the login so it is ready the next time you need it.

A personal assistant is different. It may need to use a login once to finish a job, like booking travel or posting an update. You want it to do that job, not to keep the password in its memory for later.

A password manager does not hand a secret to an assistant for one task and then take it back. It was not built for that pattern. Something else has to stand in the middle when an assistant needs access for a single job.

Jobs, spending, and where SafeAssist sits

Letting an assistant spend money or change an account is a job. It is not the same as storing the login long term. The assistant needs permission to act, then the job should end without the assistant holding your secret.

SafeAssist sits between your saved login and the assistant. You store the login in the vault. When the assistant needs it, SafeAssist uses it for that task, records what happened, and does not hand the secret to the assistant to keep.

The vault stays under your control. You can take your logins back from the dashboard when you want. The assistant gets the result of the job, not a copy of the password to reuse on its own.