Agent Vault: HTTP Credential Proxy for AI Agent Tool Calls

Infisical has introduced Agent Vault, an HTTP credential proxy designed to secure AI agent tool calls by injecting credentials on the fly and enforcing least-privilege boundaries. The proxy intercepts outbound requests from agent runtimes, injects the appropriate credentials based on route patterns, and handles rotation and audit logging without requiring agent-side SDK changes. It aims to prevent credential exposure in logs and prompts while providing centralized control and anomaly detection.

AI agents need credentials to call external APIs. The naive approach is to inject API keys into the agent's context or environment variables. That creates two problems: keys appear in logs and prompts, and agents get blanket access to every service they might touch. Agent Vault from Infisical sits as an HTTP proxy between the agent runtime and external APIs. The agent makes tool calls through the proxy, which injects credentials on the fly based on request patterns and enforces least-privilege boundaries. The vault handles rotation, audit trails, and credential resolution without requiring agent-side SDK changes. The proxy intercepts outbound HTTP requests from the agent runtime. When a request matches a configured route pattern, the vault injects the appropriate credential before forwarding the request to the target API. Core components: The agent's tool-calling code points to the proxy endpoint instead of the real API. The proxy rewrites the Host header and injects Authorization or API key headers based on the matched route. Example route configuration routes: - pattern: "api.github.com/ " credential id: "github-bot-token" inject as: "Authorization: Bearer {token}" - pattern: "api.stripe.com/ " credential id: "stripe-restricted-key" inject as: "Authorization: Bearer {token}" - pattern: "slack.com/api/ " credential id: "slack-bot-oauth" inject as: "Authorization: Bearer {token}" The agent never sees the actual credential. It only knows the proxy endpoint and the target API path. When an agent calls a tool that needs external API access: http://localhost:8080/api.github.com/repos/owner/repo If the agent tries to access an API without a matching route, the proxy returns a 403 and logs the attempt. This prevents credential exfiltration through prompt injection or tool misuse. Long-running agent workflows can span hours or days. If a credential rotates during that window, the proxy must handle it without breaking the agent's state. Agent Vault uses two strategies: Lazy refresh: The proxy checks credential expiry on each request. If the cached credential is within a configurable threshold default 5 minutes , it fetches a fresh one from the vault before forwarding the request. Background rotation: A separate goroutine polls the vault for credential updates on a schedule. When a credential changes, the proxy updates its in-memory cache. The next request automatically uses the new credential. The agent never knows rotation happened. From its perspective, the API call succeeds or fails based on business logic, not credential state. Every request through the proxy generates an audit log entry: The vault can flag suspicious patterns: These signals feed into a SIEM or alerting system. The proxy does not block requests based on heuristics too many false positives , but it surfaces anomalies for human review. Agent Vault runs in three common configurations: | Deployment | Use Case | Trade-offs | |---|---|---| Sidecar container | Agent runs in Kubernetes pod with vault as sidecar | Low latency, isolated per agent, higher resource overhead | Shared proxy service | Multiple agents route through a single vault instance | Lower resource cost, centralized audit logs, single point of failure | Embedded library | Vault runs in-process with the agent runtime | Zero network hop, harder to enforce security boundary, complicates agent deployment | Most production setups use the sidecar pattern for isolation and the shared proxy for dev environments. The proxy enforces three boundaries: Failure modes to plan for: func p Proxy ServeHTTP w http.ResponseWriter, r http.Request { // Extract target API from request path targetHost := extractHost r.URL.Path // Match route and fetch credential route := p.routeMatcher.Match targetHost, r.URL.Path if route == nil { p.auditLog.Record r, nil, 403, "no matching route" http.Error w, "Forbidden", http.StatusForbidden return } cred, err := p.vault.GetCredential route.CredentialID if err = nil { p.auditLog.Record r, route, 500, "credential fetch failed" http.Error w, "Internal Server Error", http.StatusInternalServerError return } // Inject credential into request r.Header.Set "Authorization", fmt.Sprintf "Bearer %s", cred.Token r.Host = targetHost r.URL.Host = targetHost r.URL.Scheme = "https" // Forward request to real API resp, err := p.httpClient.Do r if err = nil { p.auditLog.Record r, route, 502, "upstream error" http.Error w, "Bad Gateway", http.StatusBadGateway return } defer resp.Body.Close // Strip sensitive headers from response resp.Header.Del "X-RateLimit-Remaining" // Copy response to agent copyHeader w.Header , resp.Header w.WriteHeader resp.StatusCode io.Copy w, resp.Body p.auditLog.Record r, route, resp.StatusCode, "success" } Use Agent Vault when: Avoid it when: The proxy pattern works best when you have heterogeneous agents calling many APIs and need a single enforcement point for security policy. It adds operational complexity another service to run and monitor , but it decouples credential management from agent logic.