Credential Vaults
Isolate credentials and bind them to approved API hosts.
Vaults are credential groups that live inside one proxy. They let you bind encrypted credentials to a specific upstream host instead of allowing every request through that proxy to reference every secret.
Workflow
- Create a vault inside a proxy.
- Store the credentials required by one API provider.
- Add a predefined or custom service binding.
- Send traffic through the proxy. Proxies.ai injects the bound header only when the request host matches.
Service templates
| Template | Host | Credential |
|---|---|---|
| OpenAI | api.openai.com | OPENAI_API_KEY |
| GitHub | api.github.com | GITHUB_TOKEN |
| Anthropic | api.anthropic.com | ANTHROPIC_API_KEY |
| Stripe | api.stripe.com | STRIPE_SECRET_KEY |
| Linear | api.linear.app | LINEAR_API_KEY |
Custom bindings
A custom binding requires a target hostname, an HTTP header name, and a header value template containing at least one {$SECRET_NAME} placeholder. Proxies.ai rejects header names or templates that could introduce response splitting.
Security boundary
- Vault values remain AES-256-GCM encrypted in the proxy's local store.
- Authenticated encryption binds each ciphertext to its vault ID and secret name.
- Exact host bindings take precedence over wildcard bindings.
- A missing or expired required secret fails closed with a 403 response.
- Deleting a vault deletes its encrypted values and service bindings.
Manage vaults
Open a proxy in the dashboard and select Vaults. The same workflow is available through the CLI and REST API.