{"slug": "agent-vault-http-credential-proxy-for-ai-agent-tool-calls", "title": "Agent Vault: HTTP Credential Proxy for AI Agent Tool Calls", "summary": "Infisical has introduced Agent Vault, an HTTP credential proxy designed to secure AI agent tool calls by injecting credentials on the fly and enforcing least-privilege boundaries. The proxy intercepts outbound requests from agent runtimes, injects the appropriate credentials based on route patterns, and handles rotation and audit logging without requiring agent-side SDK changes. It aims to prevent credential exposure in logs and prompts while providing centralized control and anomaly detection.", "body_md": "AI agents need credentials to call external APIs. The naive approach is to inject API keys into the agent's context or environment variables. That creates two problems: keys appear in logs and prompts, and agents get blanket access to every service they might touch.\n\nAgent Vault from Infisical sits as an HTTP proxy between the agent runtime and external APIs. The agent makes tool calls through the proxy, which injects credentials on the fly based on request patterns and enforces least-privilege boundaries. The vault handles rotation, audit trails, and credential resolution without requiring agent-side SDK changes.\n\nThe proxy intercepts outbound HTTP requests from the agent runtime. When a request matches a configured route pattern, the vault injects the appropriate credential before forwarding the request to the target API.\n\n**Core components:**\n\nThe agent's tool-calling code points to the proxy endpoint instead of the real API. The proxy rewrites the `Host`\n\nheader and injects `Authorization`\n\nor API key headers based on the matched route.\n\n```\n# Example route configuration\nroutes:\n  - pattern: \"api.github.com/*\"\n    credential_id: \"github-bot-token\"\n    inject_as: \"Authorization: Bearer {token}\"\n\n  - pattern: \"api.stripe.com/*\"\n    credential_id: \"stripe-restricted-key\"\n    inject_as: \"Authorization: Bearer {token}\"\n\n  - pattern: \"slack.com/api/*\"\n    credential_id: \"slack-bot-oauth\"\n    inject_as: \"Authorization: Bearer {token}\"\n```\n\nThe agent never sees the actual credential. It only knows the proxy endpoint and the target API path.\n\nWhen an agent calls a tool that needs external API access:\n\n`http://localhost:8080/api.github.com/repos/owner/repo`\n\n)If the agent tries to access an API without a matching route, the proxy returns a 403 and logs the attempt. This prevents credential exfiltration through prompt injection or tool misuse.\n\nLong-running agent workflows can span hours or days. If a credential rotates during that window, the proxy must handle it without breaking the agent's state.\n\nAgent Vault uses two strategies:\n\n**Lazy refresh:** The proxy checks credential expiry on each request. If the cached credential is within a configurable threshold (default 5 minutes), it fetches a fresh one from the vault before forwarding the request.\n\n**Background rotation:** A separate goroutine polls the vault for credential updates on a schedule. When a credential changes, the proxy updates its in-memory cache. The next request automatically uses the new credential.\n\nThe agent never knows rotation happened. From its perspective, the API call succeeds or fails based on business logic, not credential state.\n\nEvery request through the proxy generates an audit log entry:\n\nThe vault can flag suspicious patterns:\n\nThese signals feed into a SIEM or alerting system. The proxy does not block requests based on heuristics (too many false positives), but it surfaces anomalies for human review.\n\nAgent Vault runs in three common configurations:\n\n| Deployment | Use Case | Trade-offs |\n|---|---|---|\nSidecar container |\nAgent runs in Kubernetes pod with vault as sidecar | Low latency, isolated per agent, higher resource overhead |\nShared proxy service |\nMultiple agents route through a single vault instance | Lower resource cost, centralized audit logs, single point of failure |\nEmbedded library |\nVault runs in-process with the agent runtime | Zero network hop, harder to enforce security boundary, complicates agent deployment |\n\nMost production setups use the sidecar pattern for isolation and the shared proxy for dev environments.\n\nThe proxy enforces three boundaries:\n\n**Failure modes to plan for:**\n\n```\nfunc (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n    // Extract target API from request path\n    targetHost := extractHost(r.URL.Path)\n\n    // Match route and fetch credential\n    route := p.routeMatcher.Match(targetHost, r.URL.Path)\n    if route == nil {\n        p.auditLog.Record(r, nil, 403, \"no matching route\")\n        http.Error(w, \"Forbidden\", http.StatusForbidden)\n        return\n    }\n\n    cred, err := p.vault.GetCredential(route.CredentialID)\n    if err != nil {\n        p.auditLog.Record(r, route, 500, \"credential fetch failed\")\n        http.Error(w, \"Internal Server Error\", http.StatusInternalServerError)\n        return\n    }\n\n    // Inject credential into request\n    r.Header.Set(\"Authorization\", fmt.Sprintf(\"Bearer %s\", cred.Token))\n    r.Host = targetHost\n    r.URL.Host = targetHost\n    r.URL.Scheme = \"https\"\n\n    // Forward request to real API\n    resp, err := p.httpClient.Do(r)\n    if err != nil {\n        p.auditLog.Record(r, route, 502, \"upstream error\")\n        http.Error(w, \"Bad Gateway\", http.StatusBadGateway)\n        return\n    }\n    defer resp.Body.Close()\n\n    // Strip sensitive headers from response\n    resp.Header.Del(\"X-RateLimit-Remaining\")\n\n    // Copy response to agent\n    copyHeader(w.Header(), resp.Header)\n    w.WriteHeader(resp.StatusCode)\n    io.Copy(w, resp.Body)\n\n    p.auditLog.Record(r, route, resp.StatusCode, \"success\")\n}\n```\n\n**Use Agent Vault when:**\n\n**Avoid it when:**\n\nThe proxy pattern works best when you have heterogeneous agents calling many APIs and need a single enforcement point for security policy. It adds operational complexity (another service to run and monitor), but it decouples credential management from agent logic.", "url": "https://wpnews.pro/news/agent-vault-http-credential-proxy-for-ai-agent-tool-calls", "canonical_source": "https://dev.to/mech_app_ai/agent-vault-http-credential-proxy-for-ai-agent-tool-calls-42m4", "published_at": "2026-08-26 20:05:51+00:00", "updated_at": "2026-08-26 20:20:19.832386+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "ai-safety", "developer-tools"], "entities": ["Infisical", "Agent Vault"], "alternates": {"html": "https://wpnews.pro/news/agent-vault-http-credential-proxy-for-ai-agent-tool-calls", "markdown": "https://wpnews.pro/news/agent-vault-http-credential-proxy-for-ai-agent-tool-calls.md", "text": "https://wpnews.pro/news/agent-vault-http-credential-proxy-for-ai-agent-tool-calls.txt", "jsonld": "https://wpnews.pro/news/agent-vault-http-credential-proxy-for-ai-agent-tool-calls.jsonld"}}