# Test accounts and secrets

> Give Re:agent an account to sign in with, without the password reaching the chat or the test.

Source: https://rehearsal.dev/docs/reagent/test-accounts

Re:agent signs in to your app with a test account, the way a person would. Signing in becomes part of the flow, and the test signs in the same way on every run.

Use an account made for testing. A test account belongs to a project and works on the addresses you pick for it.

## Kinds of account

| How it signs in | What you give | Use it for |
| --- | --- | --- |
| **With a password** | An email, username or phone number, and its password. | Apps with a sign-in form. |
| **With an email code or link** | A name. Rehearsal makes the account's address. | Apps that send a code or a link to sign in. |

Only a person can add a password account. Re:agent can add one that signs in with an email code or link.

Tests that sign up need no account. Each run signs up with a new address and a password Rehearsal keeps.

There is no option to sign in with Google, Microsoft or GitHub.

## Add an account

1. **Open Test accounts**

   In **Re:agent**, choose the project in the menu at the top. Under **Re:agent uses**, choose **Test accounts**.

2. **Choose how it signs in**

   Press **Add account**. Under **How does this account sign in?**, pick **With a password** or **With an email code or link**.

3. **Fill in the details**

   - **Name** is what you call the account, such as `admin`. It must be unique in the workspace.
   - For a password account, fill in **Email, username or phone number** and **Password**.
   - If your app asks for a code after the password, check **This account also needs a code after the password**. Pick **From an authenticator app** and paste its secret key. Or pick **Sent by email**, and the account gets its own address for the code.
   - **Where it works** appears when the project has more than one address. Pick every one it can sign in to. An address you add later is not covered.

4. **Save it**

   Press **Add account**. Adding an account needs the **Manage projects** permission.

> [!NOTE]
> An account that signs in with an email code or link gets its own address, such as `acme-admin@inbox.rehearsal.dev`. Create the account in your app with that address once.

## How Re:agent picks one

Re:agent reads the project's accounts and picks one for each browser. Each browser signs in with one account at most.

When Re:agent is not sure, it asks which account to use. You can pick one, or add one from the question. See [Questions from Re:agent](https://rehearsal.dev/docs/reagent/questions.md).

Each account in the list shows when it was last used and how that session ended.

## How secrets stay out

- The password and the secret key are saved encrypted. Re:agent never sees them.
- Re:agent types a placeholder, and Rehearsal puts the real password into the field.
- The saved step reads `{{password}}`. The written test calls `password()`, which gives the real value only while the test runs.
- A code from an authenticator app is saved as `{{authenticator}}`. The test calls `authenticatorCode()` for the current code.
- A password field takes only the test account's password, never one written in the chat.
- Codes and links from the test inbox are saved as `{{code}}` and `{{link}}`. See [The test inbox](https://rehearsal.dev/docs/reagent/test-inbox.md).
- Rehearsal takes these values out of the steps it saves, the record of Re:agent's work and run results.
- Re:agent does not ask for a password or a code in a question.

> [!NOTE]
> Keep passwords out of the chat. A message stays in the chat as you typed it, so add the password to a test account instead.

## Remove an account

Press the remove button on the account. Re:agent can no longer sign in with it.

A test that signs in with a removed account can no longer run. Its results say **Blocked**.

## Next steps

- Read how [the test inbox](https://rehearsal.dev/docs/reagent/test-inbox.md) handles codes and links.
- Test [flows with more than one person](https://rehearsal.dev/docs/reagent/more-than-one-person.md), each with their own account.