Ask HN: How do you provide your AI agents with access to credentials/secrets?

https://news.ycombinator.com/item?id=48744486

by pietz • 22 days ago

2 3 22 days ago

news.ycombinator.com

onion2k• 22 days ago

I don't. I write a lightweight API proxy, usually as a CLI app, that takes requests from the agent, adds secrets and makes the request, and then passes the response transparently to the agent. The agent can use APIs without ever seeing secrets or tokens.

This approach doesn't scale and won't work in the cloud without a lot more effort, but that's not been a problem for me yet.

pietz• 22 days ago

is this something you built yourself or do you use a tool that was specifically created for this? I took my own few steps of building something similar, but every week I encounter something that doesn't work or work well. I've reached the point where I want to consider using something, that someone smarter than me came up with.

JulienBrouchier• 21 days ago

It is a two step process : - First you create a container/sandbox/machine to contain your agent in it. If you are a dev, dev containers are a good solution. If you use OpenClaw, OpenShell is nice. there are plenty of examples on how to deploy it in a cloud instance. - Second you craft a set of credential with limited scope just for the job you want this agent to do. Don't trust the agent to restrict itself (it won't), just give it the minimum.

Practical example : you want an agent to read some of your mails and answer them. You don't give the agent access to your whole Gmail account, you create a second account for your agent and you forward the mails of interest to that second account.

Ask HN: How do you provide your AI agents with access to credentials/secrets?

Related Stories