Agent Vault: HTTP Credential Proxy for AI Agent Tool Calls

AI agents need credentials to call external APIs. The naive approach is to inject API keys into the agent's context or environment variables. That creates two problems: keys appear in logs and prompts, and agents get blanket access to every service they might touch.

Agent Vault from Infisical sits as an HTTP proxy between the agent runtime and external APIs. The agent makes tool calls through the proxy, which injects credentials on the fly based on request patterns and enforces least-privilege boundaries. The vault handles rotation, audit trails, and credential resolution without requiring agent-side SDK changes.

Architecture: Proxy Layer Between Agent and APIs

The proxy intercepts outbound HTTP requests from the agent runtime. When a request matches a configured route pattern, the vault injects the appropriate credential before forwarding the request to the target API.

Core components:

• HTTP proxy server that listens on a local port or network endpoint
• Credential store backed by Infisical's secrets engine
• Route matcher that maps request patterns to credential identities
• Audit logger that records every request, response status, and credential used
• Rotation handler that refreshes credentials on schedule or on-demand

The agent's tool-calling code points to the proxy endpoint instead of the real API. The proxy rewrites the Host header and injects Authorization or API key headers based on the matched route.

# Example route configuration
routes:
  - pattern: "api.github.com/*"
    credential_id: "github-bot-token"
    inject_as: "Authorization: Bearer {token}"

  - pattern: "api.stripe.com/*"
    credential_id: "stripe-restricted-key"
    inject_as: "Authorization: Bearer {token}"

  - pattern: "slack.com/api/*"
    credential_id: "slack-bot-oauth"
    inject_as: "Authorization: Bearer {token}"

The agent never sees the actual credential. It only knows the proxy endpoint and the target API path.

Credential Resolution Flow

When an agent calls a tool that needs external API access:

1. Agent runtime makes HTTP request to proxy (e.g., http://localhost:8080/api.github.com/repos/owner/repo)
2. Proxy parses the request path and matches it against route patterns
3. Vault retrieves the credential associated with the matched route
4. Proxy injects the credential into the request headers
5. Proxy forwards the modified request to the real API endpoint
6. API responds to the proxy
7. Proxy strips any sensitive headers from the response and forwards it to the agent
8. Audit logger writes the request metadata, credential used, and response status

If the agent tries to access an API without a matching route, the proxy returns a 403 and logs the attempt. This prevents credential exfiltration through prompt injection or tool misuse.

Handling Credential Rotation Mid-Session

Long-running agent workflows can span hours or days. If a credential rotates during that window, the proxy must handle it without breaking the agent's state.

Agent Vault uses two strategies:

Lazy refresh: The proxy checks credential expiry on each request. If the cached credential is within a configurable threshold (default 5 minutes), it fetches a fresh one from the vault before forwarding the request.

Background rotation: A separate goroutine polls the vault for credential updates on a schedule. When a credential changes, the proxy updates its in-memory cache. The next request automatically uses the new credential.

The agent never knows rotation happened. From its perspective, the API call succeeds or fails based on business logic, not credential state.

Audit Trail and Exfiltration Detection

Every request through the proxy generates an audit log entry:

• Timestamp
• Agent identity (derived from mTLS cert or API key)
• Matched route pattern
• Credential ID used
• Target API endpoint
• HTTP method and status code
• Request and response size
• Latency

The vault can flag suspicious patterns:

• Unusual volume: Agent makes 10x more API calls than baseline
• New endpoints: Agent tries to access an API it has never called before
• Failed auth: Repeated 401 or 403 responses suggest credential issues or attack attempts
• Large payloads: Response sizes that exceed expected bounds may indicate data exfiltration

These signals feed into a SIEM or alerting system. The proxy does not block requests based on heuristics (too many false positives), but it surfaces anomalies for human review.

Deployment Shapes

Agent Vault runs in three common configurations:

Most production setups use the sidecar pattern for isolation and the shared proxy for dev environments.

Security Boundaries and Failure Modes

The proxy enforces three boundaries:

1. Agent cannot read credentials directly. The vault never returns raw secrets to the agent. It only injects them into outbound requests.
2. Agent cannot access APIs outside its route map. Unmapped requests fail closed.
3. Credential rotation happens transparently. The agent cannot force the proxy to use a stale or revoked credential.

Failure modes to plan for:

• Proxy downtime: Agent tool calls fail until the proxy recovers. Use health checks and automatic restarts.
• Vault unavailable: Proxy cannot fetch credentials. Cache credentials with TTL to survive short outages, but fail open vs. fail closed is a policy decision.
• Route misconfiguration: Agent cannot reach a legitimate API. Audit logs show 403s, but the agent has no visibility into why.
• Credential revocation: If a credential is revoked in the vault, the next request fails. The agent must handle 401/403 gracefully and surface the error to the orchestrator.

Code Snippet: Proxy Request Handler

func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    // Extract target API from request path
    targetHost := extractHost(r.URL.Path)

    // Match route and fetch credential
    route := p.routeMatcher.Match(targetHost, r.URL.Path)
    if route == nil {
        p.auditLog.Record(r, nil, 403, "no matching route")
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }

    cred, err := p.vault.GetCredential(route.CredentialID)
    if err != nil {
        p.auditLog.Record(r, route, 500, "credential fetch failed")
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // Inject credential into request
    r.Header.Set("Authorization", fmt.Sprintf("Bearer %s", cred.Token))
    r.Host = targetHost
    r.URL.Host = targetHost
    r.URL.Scheme = "https"

    // Forward request to real API
    resp, err := p.httpClient.Do(r)
    if err != nil {
        p.auditLog.Record(r, route, 502, "upstream error")
        http.Error(w, "Bad Gateway", http.StatusBadGateway)
        return
    }
    defer resp.Body.Close()

    // Strip sensitive headers from response
    resp.Header.Del("X-RateLimit-Remaining")

    // Copy response to agent
    copyHeader(w.Header(), resp.Header)
    w.WriteHeader(resp.StatusCode)
    io.Copy(w, resp.Body)

    p.auditLog.Record(r, route, resp.StatusCode, "success")
}

Technical Verdict

Use Agent Vault when:

• You run agents that call multiple third-party APIs and need centralized credential management.
• You want audit logs for every API call without modifying agent code.
• You need to rotate credentials without restarting agent workflows.
• You want to enforce least-privilege access at the HTTP layer.

Avoid it when:

• Your agent only calls a single API and you can inject credentials via environment variables.
• You need sub-millisecond latency and cannot tolerate an extra network hop.
• Your agent runtime already has a robust secrets management layer (e.g., AWS Secrets Manager with IAM roles).
• You prefer SDK-based credential injection over HTTP proxying.

The proxy pattern works best when you have heterogeneous agents calling many APIs and need a single enforcement point for security policy. It adds operational complexity (another service to run and monitor), but it decouples credential management from agent logic.

Source Links

• Agent Vault GitHub Repository
• Hacker News Discussion