Skip to main content

AI-agent security guide

Keep API Keys Away from AI Agents

Use credential brokering, destination policy, approvals, and audit trails to keep long-lived API keys outside AI agent prompts, tools, code, and logs.

Short answer

Keep API keys away from AI agents by separating permission to use a service from possession of its long-lived credential. Store secrets in an encrypted vault, bind use to approved destinations and request policy, and make sensitive actions revocable and observable.

Start with the exposure paths

An API key can escape through a prompt, tool argument, environment dump, debug trace, source file, notebook, or log. Treat all agent-readable surfaces as potential disclosure paths. Avoid copying long-lived credentials into system prompts or asking a model to keep a secret hidden as a substitute for access control.

Move custody outside the agent

Store the upstream credential in an encrypted secret store that does not return its value through normal read APIs. Give the agent a separate, revocable way to route a request. The proxy or broker should resolve the credential only at the boundary where a permitted request is prepared for forwarding.

Restrict destinations and actions

A credential is only as narrow as its upstream scope and the destinations where it may be used. Bind secrets to required hosts, restrict methods or paths when the policy engine supports them, and use human approval for sensitive actions. A compromised agent may still use every action left inside its allowed envelope.

Practical checklist

  • Use upstream credentials with the minimum necessary permissions.
  • Store values only in the approved encrypted secret store.
  • Bind each secret to a narrow service host and review wildcards carefully.
  • Exercise rotation, expiry, deletion, and proxy-unavailable failure cases.
  • Treat tool results and upstream responses as potentially sensitive data.

Apply the pattern with Hyperproxy

Hyperproxy lets an agent route standard HTTP traffic through a dedicated proxy and use configured placeholders or proxy credentials. Auto-Auth handles header injection; Firewall mode adds TLS inspection and CEL policy decisions. Use a narrow service binding, verify denied requests, and retain a way to revoke access. The network boundary reduces direct key exposure; it does not guarantee prompt-injection prevention or safe use of approved API operations.

Sources

Safe example

export CIFP_PROXY_URL='https://user:pass@<proxy-host>:443'
curl -x "$CIFP_PROXY_URL" \
  -H 'Authorization: Bearer {$SERVICE_TOKEN}' \
  https://api.example.com/v1/resource