What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Give an AI agent permission to request an API operation, not access to the API key itself. Keep the credential in a trusted application or outbound proxy, which attaches it only after checking the operation and destination. A secrets manager protects the stored value, but it cannot protect a secret after plaintext has been placed in an agent-readable environment, prompt, tool argument, or log.
How can an agent call an API without seeing its key?
Put authentication at the request boundary, outside the model’s view. The model asks to perform a named operation; a policy or tool layer checks the request; a trusted application or egress proxy adds authentication; the upstream API responds; and only a sanitized result returns to the model.
As an Amazon Associate I earn from qualifying purchases.
- Model: requests an allowed operation with the necessary non-secret arguments.
- Policy or tool layer: validates the operation and its arguments.
- Trusted request handler: attaches the credential for the approved API destination.
- Upstream service: processes the authenticated request.
- Return path: filters the response before exposing it to the model or retaining it in logs.
This separates two questions that are often confused: where a secret is stored, and which component can read or use its plaintext. A vault can provide protected storage and access controls, but if its secret is copied into a process the agent can inspect, storage has not made that process a security boundary. OpenAI’s sandbox security guidance warns that “Agent-generated code can access the files, credentials, and network available to its environment.”
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the request mechanism that matches where the agent runs
| Approach | Where authentication is added | Best fit and boundaries |
|---|---|---|
| OpenAI-hosted sandbox credential proxy | OpenAI’s network proxy substitutes a real credential for a placeholder on eligible outbound HTTPS requests. | For API requests from an OpenAI-hosted sandbox. Configure both the sandbox’s allowed network domains and the credential’s allowed hosts for the intended destination. The proxy flow is not a way to provide credentials to self-hosted runtimes or application-run function tools. |
| Operator-run proxy or server | A trusted service outside the agent environment adds the credential when forwarding an approved request. | For self-hosted agents, when the operator can enforce destination and operation policy at the service boundary. The operator must implement and maintain that boundary. |
| Application-side function tool | The application that executes the function uses its own credential to call the upstream API. | For agents whose tools run in an application you control. Keep the secret in the application and return only the necessary result. Use this pattern when authentication requires local signing or another operation that needs plaintext. |
OpenAI’s secure tool-use documentation describes the hosted credential flow and the distinction between hosted sandbox requests and application-side tools. The mechanism must match the actual execution location: a credential feature for one managed environment should not be assumed to protect another runtime.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
OpenAI-hosted sandbox: placeholder plus outbound proxy
OpenAI documents vault credentials of type environment_variable for requests made from an OpenAI-hosted sandbox. The sandbox receives a placeholder in a named environment variable; for HTTPS requests, the proxy can replace that placeholder with the real value when the request goes to a configured allowed host. The documented setup requires the destination to be covered by both the network allowed_domains and the credential’s allowed_hosts. These controls serve different purposes: one restricts where the sandbox can connect, while the other restricts where the proxy can attach the credential.
The placeholder approach does not make the real key available for arbitrary local computation. If the authentication scheme requires the agent environment to use plaintext—for example, to sign a request locally—keep that work in an application-side service and expose a narrowly defined function tool instead. OpenAI also distinguishes credential types by request location: static_bearer or mcp_oauth apply to an MCP connection from OpenAI, while environment_variable applies to API requests from an OpenAI-hosted sandbox. Retrieving a vault credential does not return its secret value. Consult the current OpenAI credential documentation for the configuration and supported behavior.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Self-hosted agent: put the proxy outside the agent
For a self-hosted environment, OpenAI’s guidance places responsibility on the operator to configure a trusted proxy or server outside the agent environment to supply secrets. Do not pass a key into the agent’s process and assume a vault has hidden it. Make the proxy the only component that can read the credential, and have it forward only approved requests.
Recommended Free Tools
Application-run function tool: keep the key in the calling application
When your application executes the tool, keep the credential in that application’s protected configuration or secret store. The tool implementation should validate inputs, make the authenticated request, and return only the fields the agent needs. Do not include the key in tool arguments or results. This approach also accommodates authentication operations that cannot be handled by substituting a placeholder at an outbound proxy.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Google managed agents: a platform-specific proxy model
Google’s managed-agent documentation describes server-managed credentials attached to allowlisted network rules. Its documented forms include bearer_token, oauth2, and environment_variable. For the environment-variable form, the agent sees a placeholder and the proxy substitutes the secret for requests to the credential’s trusted_domains; a request to an untrusted domain is rejected. The documentation describes secret values as write-only, while literal environment-variable values in a sandbox are readable by code running there. These are Google platform behaviors, not guarantees that apply to every agent framework. See Google’s managed-agent credentials documentation.
What controls should surround the credential?
A proxy or function tool is only useful if it limits what the agent can ask it to do. Scope the operation, destination, credential, and workload rather than handing an agent broad access to a general-purpose key.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Limit operations: expose specific actions and validate arguments; avoid unrestricted shell, filesystem, or generic HTTP tools when a narrower interface will work.
- Limit destinations: use outbound network allowlists and credential host allowlists. Do not let an agent choose an arbitrary host for an authenticated request.
- Limit credential authority: use the narrowest permissions the upstream service offers, and prefer a unique identity for each workload, user, or task rather than sharing a broad credential across sessions.
- Isolate execution: keep the proxy and secret store outside the agent-readable environment, and restrict access between workloads.
- Limit exposure in outputs: return only required response fields, redact sensitive values from errors and traces, and prevent secret-bearing outputs from entering conversation memory.
- Use an appropriate lifetime: prefer short-lived, task-scoped credentials where the provider supports them, and provide a clear revocation path.
OWASP’s 2025 MCP01 guidance on token mismanagement discusses risks such as excessive token privileges, weak lifecycle controls, and credential exposure. Its Secrets Management Cheat Sheet covers protected storage, access control, auditing, and rotation. A secret manager—such as AWS Secrets Manager, Google Secret Manager, Azure Key Vault, or HashiCorp Vault—can support those lifecycle controls, but it does not replace a safe boundary for using the secret.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Where should secrets never appear?
Treat every surface the model or agent can inspect, repeat, or log as potentially exposed. Keep credentials out of:
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Prompts, conversation history, memory, and context files.
- Generated source code, repositories, project
.envfiles, and screenshots or other source images. - Tool arguments, tool results, exception messages, debug output, telemetry, and unredacted traces.
- Files the agent can read, even when those files are excluded from version control.
.gitignore prevents specified files from being tracked by Git; it does not stop an AI tool with filesystem access from reading them. OWASP’s LLM Prompt Injection Prevention Cheat Sheet recommends excluding sensitive files from AI context. Exclusion from context is useful, but it is not a substitute for keeping plaintext out of the agent’s accessible environment.
Are environment variables safe for AI agents?
Not if the agent or agent-generated code can read the process environment. An environment variable can keep a key out of a source file, but it is not a security boundary against code running with access to that variable. A vault does not change this if it injects the real value into the agent’s environment.
A placeholder in an environment variable is different: it can give the agent a value for making a request while a trusted proxy retains and substitutes the real credential at the outbound boundary. That protection depends on the platform’s documented implementation, correct host and network restrictions, and the credential not being exposed through another path. Do not assume the same behavior for a literal secret, a different provider, or a self-hosted agent.
What should you do if a key may have been exposed?
- Revoke or rotate it at the issuing service. Treat a key found in an agent-readable file, prompt, tool result, or log as exposed.
- Replace it through the trusted boundary. Update the proxy or application’s secret store rather than adding the replacement to agent context.
- Review access records. Check the upstream service, proxy, and secret manager for unexpected use, while remembering that logs may not capture every path.
- Remove secondary copies. Clean up affected files, conversation or task memory, and logs where feasible; apply redaction controls to retained telemetry.
- Reduce the chance of recurrence. Narrow the credential’s permissions and allowed hosts, shorten its lifetime if supported, and review which components can read plaintext.
OWASP’s secrets-management guidance treats rotation, revocation, access control, and audit as lifecycle responsibilities, not one-time setup tasks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
