You can build apps hosted on HF which access third party APIs, e.g. OpenAI or Anthropic. The api keys for these are then stored in the HF secrets

Usually you need some sort of "token" that lets you practically operate within a browser session. It seems like this is about tokens they had to revoke, which is kinda like a password but not.