Secure credential proxy for AI agents. Make API calls through AgentKeys — real secrets never leave the vault.
Secure credential proxy for AI agents. Route API calls through AgentKeys so your agent never sees real secrets.
You have two options. Set these in your environment or .env:
AGENTKEYS_API_KEY=ak_ws_...
AGENTKEYS_PROXY_URL=https://proxy.agentkeys.io
Use your workspace API key to proxy requests to any credential by name. Get your API key from Settings.
AGENTKEYS_PROXY_TOKEN=pxr_...
AGENTKEYS_PROXY_URL=https://proxy.agentkeys.io
Use a proxy token for one specific credential. Get it by assigning a credential to an agent in the dashboard.
curl -X POST $AGENTKEYS_PROXY_URL/v1/proxy \
-H "Authorization: Bearer $AGENTKEYS_API_KEY" \
-H "X-Credential-Name: resend" \
-H "X-Target-Url: https://api.resend.com/emails" \
-H "Content-Type: application/json" \
-d '{"from": "[email protected]", "to": "[email protected]", "subject": "Hello", "text": "Sent via AgentKeys"}'
curl -X POST $AGENTKEYS_PROXY_URL/v1/proxy \
-H "Authorization: Bearer $AGENTKEYS_PROXY_TOKEN" \
-H "X-Target-Url: https://api.resend.com/emails" \
-H "Content-Type: application/json" \
-d '{"from": "[email protected]", "to": "[email protected]", "subject": "Hello", "text": "Sent via AgentKeys"}'
| Header | Required | Description |
|---|---|---|
Authorization | ✅ | Bearer $AGENTKEYS_API_KEY or Bearer $AGENTKEYS_PROXY_TOKEN |
X-Target-Url | ✅ | Target API URL to forward to |
X-Credential-Name | ✅ (API key mode) | Name of the credential to use (case-insensitive) |
Content-Type | ❌ | Passed through to target |
The agent never sees the real API key, OAuth token, or password.
Authorization: Bearer <key>Authorization: Basic base64(user:pass)Cookie header