A workflow called with uses: owner/repo/.github/workflows/file.yml@ref does not automatically receive the caller's secrets. The called workflow must declare each secret under on: workflow_call: secrets:, and the caller must pass it under with-style secrets: mapping, or use secrets: inherit to forward everything the caller has.
The failure mode is an empty secret rather than an error. A step that authenticates with an empty token fails at the remote service with a confusing 401, and because GitHub masks secrets in logs there is nothing visible to distinguish an empty value from a redacted one.
secrets: inherit forwards the caller's full secret set including organization secrets, which is convenient and also the reason it should not be used when calling a workflow from another repository. Reusable workflows are limited to four levels of nesting, and a nested call must itself use inherit or explicit passing at every level. The env context of the caller is never visible to the called workflow, which is a separate and frequently conflated limitation.