Sensitive configuration values such as passwords, API keys, and tokens. These must be provided as file paths to the secrets, which will be read at activation time.
These values are expanded in a shell context within a systemd service, so you can use bash features like command substitution or variable expansion (e.g. "${XDG_RUNTIME_DIR}" as used by agenix).