AI agents need credentials to call external APIs. The naive approach is to inject API keys into the agent's context or environment variables. That creates two problems: keys appear in logs and prompts, and agents get blanket access to every service they might touch.
Agent Vault from Infisical sits as an HTTP proxy between the agent runtime and external APIs. The agent makes tool calls through the proxy, which injects credentials on the fly based on request patterns and enforces least-privilege boundaries. The vault handles rotation, audit trails, and credential resolution without requiring agent-side SDK changes.
Architecture: Proxy Layer Between Agent and APIs
The proxy intercepts outbound HTTP requests from the agent runtime. When a request matches a configured route pattern, the vault injects the appropriate credential before forwarding the request to the target API.
Core components:
