Credential Vault

AgenticGuard stores API keys and tokens in an encrypted vault and injects them automatically into outgoing requests — your agents never see the raw secrets.

How injection works

When AgenticGuard forwards a request, it:

1. Extracts the target hostname (e.g. api.github.com)
2. Searches the vault for a credential matching that hostname
3. If found, injects it as a Bearer token, custom header, or query parameter
4. Forwards the enriched request

Matching is done first by exact hostname, then by substring. A credential named github with hostname api.github.com will match any request to that host.

Credential types

Type	Injected as
bearer	Authorization: Bearer {value}
header	Custom header: {header_name}: {value}
query	Query parameter: ?{param_name}={value}

Adding a credential

Go to Credentials in the dashboard and click Add Credential:

• Name: human-readable label (e.g. github-prod)
• Hostname: the hostname to match (e.g. api.github.com)
• Type: bearer / header / query
• Value: the secret (stored encrypted, never shown again)

Or via API:

curl -X POST https://api.agentic-guard.com/credentials \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "github-prod",
    "hostname": "api.github.com",
    "cred_type": "bearer",
    "value": "ghp_xxxxxxxxxxxx"
  }'

Encryption

Credentials are encrypted with AES-256-GCM using a per-organization key. The plaintext value is never written to the database. Once saved, the value cannot be retrieved — only replaced.

Hostname matching

Credential hostname: api.github.com
Request URL: https://api.github.com/repos/openai/openai-python
Result: MATCH ✓

Credential hostname: github
Request URL: https://api.github.com/user
Result: MATCH ✓ (substring)

Credential hostname: stripe.com
Request URL: https://api.stripe.com/v1/charges
Result: MATCH ✓ (substring)

Multiple credentials per hostname

If multiple credentials match a hostname, the most recently created one is used. To use a specific credential, ensure only one matches the target hostname.

Rotating credentials

Delete the old credential and create a new one with the same hostname. The new credential is picked up immediately on the next request.