A secret manager stores credentials and controls access to them; an agent credential gateway mediates calls between an AI agent and its tools, enforcing who can call what and sometimes injecting credentials at request time. They are complementary roles, not interchangeable labels: a gateway can use a secret manager as its credential source.
What each component does
Secret manager: custody and lifecycle
A secret manager is the system of record for sensitive values such as API keys, OAuth client secrets, and tokens. It centralizes storage and access, and may support credential brokering and OAuth flows. Google describes its Agent Identity auth manager as a centralized credential vault and authentication broker; its documented capabilities include API keys, OAuth client credentials, and delegated user tokens. Google Cloud: Agent Identity auth manager overview
As an Amazon Associate I earn from qualifying purchases.
Credential gateway: call mediation and enforcement
A gateway sits in the tool-call path. It can verify an agent, authorize a request, constrain access to tools, and inspect traffic. AWS describes AgentCore Gateway as centralizing tool access and managing inbound authentication and outbound authorization. Google describes Agent Gateway as enforcing access policies and inspecting traffic. AWS Prescriptive Guidance: Capability 5 · Google Cloud: Agent Identity overview
Products may combine or overlap these functions. Compare the actual request path and controls, rather than relying on the product label “gateway” or “vault.”
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Where the secret goes matters most
Encryption at rest does not answer whether a credential is exposed while a request is made. The important boundary is which component handles the plaintext: the model or its context, the agent process, a trusted adapter, or a gateway. If agent code reads a secret from a vault and adds it to an outbound request, the secret may stay out of the prompt but still enter the agent-side runtime.
Google documents an auth-manager flow in which an agent retrieves a credential and attaches headers before dispatch. That is brokerage, but the credential still enters the agent-side call path. By contrast, in a documented Agent Gateway and Gemini Enterprise arrangement, the gateway decrypts end-user credentials so the agent does not access the raw value. Google’s Gemini managed-agent documentation also describes an egress proxy that injects server-managed credentials at request time, keeping the secret out of the agent environment. These are specific documented configurations, not a guarantee for every integration. Auth manager overview · Agent Identity overview · Google AI for Developers: Credentials in managed agents
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Google says of managed-agent credentials: “Credentials are server-managed secrets that let your agents reach third-party services without the secret ever entering the agent’s environment.” Confirm that the feature and network path you plan to use match this documented behavior.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How authentication fits together
There is not just one “agent authentication” link. AWS guidance distinguishes user-to-agent, agent-to-tool, and tool-to-downstream-system relationships. A design should state which identity is checked at each link and who authorizes the action. AWS Prescriptive Guidance: Capability 5
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
- User to agent: Who is allowed to use the agent, and how is that user authenticated?
- Agent to tool: Does the agent act under its own workload identity, or with delegated authority from a user?
- Tool to downstream service: Which credential reaches the API, and where is it applied?
Google documents both per-agent identity and user-delegated OAuth patterns. Its Agent Identity overview says each agent can have a strongly attested cryptographic identity based on SPIFFE. Delegated access raises additional questions: how consent is obtained, how tokens are refreshed, and whether logs can connect the action to both agent and user. Google Cloud: Agent Identity overview
What the distinction looks like in documented products
| Example | Documented role | Qualification |
|---|---|---|
| Google Cloud Agent Identity | Per-agent identity that integrates with the auth manager and Agent Gateway; the gateway enforces policies and inspects traffic. | Check supported environments and authentication models for the target runtime. Source |
| Google Cloud Agent Identity auth manager | Credential vault and broker for API keys, OAuth client credentials, and delegated user tokens. One described flow retrieves a credential and attaches headers before dispatch. | This flow puts the credential in the agent-side call path; it is distinct from gateway-side injection. Source |
| Google Agent Gateway with Gemini Enterprise | In the documented arrangement, the gateway decrypts end-user credentials and the agent does not access the raw credential. | Do not assume the same boundary applies to other integrations. Source |
| Gemini managed-agent egress proxy | Resolves and injects server-managed secrets at request time; documented credential types include bearer tokens, OAuth2, and environment-variable substitution. | Described for managed agents. Check current availability and exact network rules. Source |
| AWS AgentCore Gateway with AWS Secrets Manager | Gateway centralizes agent-tool access; AWS recommends storing client IDs and secrets in Secrets Manager and using least-privilege roles and scopes. | Guidance describes multiple authentication choices; select one supported by the target and scope it tightly. Source |
| HashiCorp Vault Enterprise agentic IAM | Validates OAuth JWTs, resolves client identity, checks agent registry status, and applies authorization constraints. | HashiCorp identifies this Agentic IAM capability as available in Vault Enterprise 2.1.0 and later; verify current version and license. Source |
How to choose or combine them
Use the architecture that places each responsibility at the right boundary. A secret manager is useful for centralized custody and lifecycle controls. A gateway is useful when tool calls need a central enforcement point. In many designs, the gateway retrieves or brokers credentials from the secret manager and applies them without returning raw values to the agent. Verify that this is true for the specific integration rather than assuming it from the product category.
Quick Recap
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
- Plaintext boundary: Does the secret enter model context, agent memory or environment, tool arguments, traces, or logs? Can a proxy inject it without exposing it to agent code?
- Identity granularity: Does each agent have a distinct workload identity, or do several agents share a service account or secret? Google documents SPIFFE-based per-agent identity; AWS recommends least-privilege IAM roles.
- Authority model: Does the agent act as itself, or on a user’s behalf with delegated OAuth permissions?
- Enforcement point: Is authorization checked when a secret is read, when a tool is invoked, at the gateway, or by the downstream API? Prefer controls that restrict the actual call, not merely access to a stored value.
- Credential lifecycle: Identify who handles OAuth consent, token exchange and refresh, rotation, dynamic or short-lived credentials, and revocation. Confirm which of these the selected product actually supports.
- Audit attribution: Can records identify both the agent and, when relevant, the delegated user? Google documents attribution to both identities; Vault documents audit metadata for its agentic IAM flow.
- Deployment and licensing: Check runtime support, cloud and IAM integration, deployment model, and license. The cited HashiCorp agentic IAM capability is an Enterprise feature.
Questions to answer before deployment
- Does the model receive a secret value, or only an opaque tool or credential identifier?
- Does the agent process receive the secret in memory or through an environment variable even if the prompt never contains it?
- Can server-side policy restrict destinations, HTTP methods, scopes, and individual tools?
- How are delegated user permissions consented to, refreshed, attributed, and revoked?
- Do request logs, traces, tool arguments, or error messages capture authorization headers or other secret material?
- If an agent is compromised, can its credentials be revoked independently and its access separated from other agents?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
