AI agents need credentials to call external APIs. The naive approach is to inject API keys into the agent's context or environment variables. That creates two problems: keys appear in logs and prompts, and agents get blanket access to every service they might touch.
Agent Vault from Infisical sits as an HTTP proxy between the agent runtime and external APIs. The agent makes tool calls through the proxy, which injects credentials on the fly based on request patterns and enforces least-privilege boundaries. The vault handles rotation, audit trails, and credential resolution without requiring agent-side SDK changes.
The proxy intercepts outbound HTTP requests from the agent runtime. When a request matches a configured route pattern, the vault injects the appropriate credential before forwarding the request to the target API.
Core components:
The agent's tool-calling code points to the proxy endpoint instead of the real API. The proxy rewrites the Host
header and injects Authorization
or API key headers based on the matched route.
routes:
- pattern: "api.github.com/*"
credential_id: "github-bot-token"
inject_as: "Authorization: Bearer {token}"
- pattern: "api.stripe.com/*"
credential_id: "stripe-restricted-key"
inject_as: "Authorization: Bearer {token}"
- pattern: "slack.com/api/*"
credential_id: "slack-bot-oauth"
inject_as: "Authorization: Bearer {token}"
The agent never sees the actual credential. It only knows the proxy endpoint and the target API path.
When an agent calls a tool that needs external API access:
http://localhost:8080/api.github.com/repos/owner/repo
)If the agent tries to access an API without a matching route, the proxy returns a 403 and logs the attempt. This prevents credential exfiltration through prompt injection or tool misuse.
Long-running agent workflows can span hours or days. If a credential rotates during that window, the proxy must handle it without breaking the agent's state.
Agent Vault uses two strategies:
Lazy refresh: The proxy checks credential expiry on each request. If the cached credential is within a configurable threshold (default 5 minutes), it fetches a fresh one from the vault before forwarding the request.
Background rotation: A separate goroutine polls the vault for credential updates on a schedule. When a credential changes, the proxy updates its in-memory cache. The next request automatically uses the new credential.
The agent never knows rotation happened. From its perspective, the API call succeeds or fails based on business logic, not credential state.
Every request through the proxy generates an audit log entry:
The vault can flag suspicious patterns:
These signals feed into a SIEM or alerting system. The proxy does not block requests based on heuristics (too many false positives), but it surfaces anomalies for human review.
Agent Vault runs in three common configurations:
| Deployment | Use Case | Trade-offs |
|---|---|---|
| Sidecar container | ||
| Agent runs in Kubernetes pod with vault as sidecar | Low latency, isolated per agent, higher resource overhead | |
| Shared proxy service | ||
| Multiple agents route through a single vault instance | Lower resource cost, centralized audit logs, single point of failure | |
| Embedded library | ||
| Vault runs in-process with the agent runtime | Zero network hop, harder to enforce security boundary, complicates agent deployment |
Most production setups use the sidecar pattern for isolation and the shared proxy for dev environments.
The proxy enforces three boundaries:
Failure modes to plan for:
func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
// Extract target API from request path
targetHost := extractHost(r.URL.Path)
// Match route and fetch credential
route := p.routeMatcher.Match(targetHost, r.URL.Path)
if route == nil {
p.auditLog.Record(r, nil, 403, "no matching route")
http.Error(w, "Forbidden", http.StatusForbidden)
return
}
cred, err := p.vault.GetCredential(route.CredentialID)
if err != nil {
p.auditLog.Record(r, route, 500, "credential fetch failed")
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
return
}
// Inject credential into request
r.Header.Set("Authorization", fmt.Sprintf("Bearer %s", cred.Token))
r.Host = targetHost
r.URL.Host = targetHost
r.URL.Scheme = "https"
// Forward request to real API
resp, err := p.httpClient.Do(r)
if err != nil {
p.auditLog.Record(r, route, 502, "upstream error")
http.Error(w, "Bad Gateway", http.StatusBadGateway)
return
}
defer resp.Body.Close()
// Strip sensitive headers from response
resp.Header.Del("X-RateLimit-Remaining")
// Copy response to agent
copyHeader(w.Header(), resp.Header)
w.WriteHeader(resp.StatusCode)
io.Copy(w, resp.Body)
p.auditLog.Record(r, route, resp.StatusCode, "success")
}
Use Agent Vault when:
Avoid it when:
The proxy pattern works best when you have heterogeneous agents calling many APIs and need a single enforcement point for security policy. It adds operational complexity (another service to run and monitor), but it decouples credential management from agent logic.