{"docsConfig":{"theme":"aspen","$schema":"https://mintlify.com/docs.json","name":"Infisical","colors":{"primary":"#26272b","light":"#dbf530","dark":"#A1B659"},"logo":{"light":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/light.svg","dark":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/dark.svg","href":"/"},"favicon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico","api":{"openapi":"https://app.infisical.com/api/docs/json","mdx":{"server":["https://app.infisical.com"]}},"appearance":{"default":"light"},"background":{"color":{"light":"#ffffff","dark":"#08090b"}},"navbar":{"links":[{"href":"https://app.infisical.com/login","label":"Log In"}],"primary":{"type":"button","label":"Start for Free","href":"https://app.infisical.com/signup"}},"footer":{"socials":{"x":"https://www.twitter.com/infisical","linkedin":"https://www.linkedin.com/company/infisical","github":"https://github.com/Infisical/infisical-cli","website":"https://community.infisical.com"},"links":[{"header":"PRODUCT","items":[{"label":"Secrets Management","href":"https://infisical.com/platform/secrets-management"},{"label":"Certificate Management","href":"https://infisical.com/platform/certificate-management"},{"label":"Privileged Access Management (PAM)","href":"https://infisical.com/platform/pam"},{"label":"Agent Vault","href":"https://infisical.com/platform/agent-vault"},{"label":"Key Management Service (KMS)","href":"https://infisical.com/docs/documentation/platform/kms/overview"},{"label":"Secret Scanning","href":"https://infisical.com/radar"},{"label":"Share Secrets","href":"https://app.infisical.com/share-secret"},{"label":"Pricing","href":"https://infisical.com/pricing"},{"label":"Security","href":"https://infisical.com/docs/internals/security"},{"label":"Blog","href":"https://infisical.com/blog"},{"label":"Infisical vs Vault","href":"https://infisical.com/infisical-vs-hashicorp-vault"},{"label":"Community","href":"https://community.infisical.com/"}]},{"header":"USE CASES","items":[{"label":"Infisical Agent","href":"https://infisical.com/docs/documentation/getting-started/introduction"},{"label":"Infisical Proxy","href":"https://infisical.com/docs/integrations/platforms/infisical-proxy"},{"label":"Kubernetes","href":"https://infisical.com/docs/integrations/platforms/kubernetes"},{"label":"Dynamic Secrets","href":"https://infisical.com/docs/documentation/platform/dynamic-secrets/overview"},{"label":"Terraform","href":"https://registry.terraform.io/providers/Infisical/infisical/latest/docs"},{"label":"Ansible","href":"https://infisical.com/docs/integrations/platforms/ansible"},{"label":"Jenkins","href":"https://infisical.com/docs/integrations/cicd/jenkins"},{"label":"Docker","href":"https://infisical.com/docs/integrations/platforms/docker"},{"label":"AWS ECS","href":"https://infisical.com/docs/integrations/platforms/ecs-with-agent"},{"label":"GitLab","href":"https://infisical.com/docs/integrations/cicd/gitlab"},{"label":"GitHub","href":"https://infisical.com/docs/integrations/cicd/githubactions"},{"label":"SDK","href":"https://infisical.com/docs/sdks/overview"}]},{"header":"DEVELOPERS","items":[{"label":"Changelog","href":"https://github.com/Infisical/infisical/releases"},{"label":"Status","href":"https://status.infisical.com/"},{"label":"Feedback \u0026 Requests","href":"https://github.com/Infisical/infisical/issues"},{"label":"Trust of Center","href":"https://app.vanta.com/infisical.com/trust/hoop8cr78cuarxo9sztvs"},{"label":"Open Source Friends","href":"https://infisical.com/infisical-friends"},{"label":"How to contribute","href":"https://www.infisical.com/infisical-heroes"}]},{"header":"OTHERS","items":[{"label":"Customers","href":"https://infisical.com/customers/traba"},{"label":"Company Handbook","href":"https://infisical.com/wiki/handbook/overview"},{"label":"Careers","href":"https://infisical.com/careers"},{"label":"Terms of Service","href":"https://infisical.com/terms"},{"label":"Privacy Policy","href":"https://infisical.com/privacy"},{"label":"Subprocessors","href":"https://infisical.com/subprocessors"},{"label":"SLA","href":"https://infisical.com/sla"},{"label":"Support Email","href":"mailto:support@infisical.com"},{"label":"Sales","href":"mailto:sales@infisical.com"},{"label":"Support","href":"https://community.infisical.com"}]}]},"fonts":{"heading":{"family":"Alliance","weight":400,"source":"https://infisical.com/docs/fonts/AllianceNo2-Regular.woff2","format":"woff2"}},"icons":{"library":"lucide"},"styling":{"eyebrows":"breadcrumbs","codeblocks":"dark","latex":false},"integrations":{"posthog":{"apiKey":"phc_Q0xfB3LeOqo7ySk4DE6zLNwDzHFesKcmigknCy4fTdV","apiHost":"https://p.infisical.com"},"koala":{"publicApiKey":"pk_b50d7184e0e39ddd5cdb43cf6abeadd9b97d"},"gtm":{"tagId":"GTM-WL5C7MWT"}},"contextual":{"options":["assistant","copy","view","chatgpt","claude","mcp"],"display":"header"},"thumbnails":{"appearance":"light"},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"infisical","hasAudioNarration":false,"actualSubdomain":"infisical","customDomains":["infisical.com"],"gitSource":{"type":"github","owner":"infisical","repo":"infisical","deployBranch":"main","contentDirectory":"docs","mountPath":"","label":""},"feedback":{"thumbs":true,"edits":true,"issues":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6aef4cdb5a64506a9069dd0f","clientVersion":"0.0.4076","searchFilterCounts":[{"language":"default","tag":"Reference","count":1883},{"language":"default","tag":"API","count":1840},{"language":"default","tag":"Secrets Management","count":913},{"language":"default","tag":"App connections","count":658},{"language":"default","tag":"Shared","count":572},{"language":"default","tag":"Secret syncs","count":420},{"language":"default","tag":"Products","count":375},{"language":"default","tag":"Certificate Management","count":324},{"language":"default","tag":"Platform","count":249},{"language":"default","tag":"Secret rotations","count":221}]},"assistantConfig":{"enableAskAiButton":true,"enableAskAiSearchBar":false},"basePath":"/docs","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"selectively-prewarm","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instinct-self-updating-docs","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"style.css","href":"/docs/_mintlify/custom/infisical/792e2875e269d30a/style.css"}],"page":{"pagePath":"documentation/platform/agent-vault/plan-your-setup","slug":"/documentation/platform/agent-vault/plan-your-setup","pageMetadata":{"title":"Plan your Agent Vault setup","sidebarTitle":"Plan your setup","description":"Get a recommended Agent Vault setup for what you're building.","mode":"frame","href":"/documentation/platform/agent-vault/plan-your-setup"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Get a recommended Agent Vault setup for what you’re building.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];const AgentVaultSetupBranch=({building,runs,agent,model,children})=>{const SELECTION_EVENT=`av-setup-selection-change`;const RULES={personal:{model:`user`,runs:[`container`,`server`]},scheduled:{model:`job`,runs:[`container`,`ci`,`server`]},platform:{model:`orchestrator`,runs:[`modal`,`daytona`,`e2b`,`kubernetes`,`container`,`cursor`,`server`]}};const ALL_AGENTS=[`claude-code`,`codex`,`opencode`,`hermes`,`openclaw`,`custom`];const readSelection=()=>{const params=new URLSearchParams(window.location.search);const buildingId=Object.prototype.hasOwnProperty.call(RULES,params.get(`building`))?params.get(`building`):`platform`;const rule=RULES[buildingId];const runsId=params.get(`runs`);const agentId=params.get(`agent`);const validRuns=rule.runs.includes(runsId)?runsId:null;return{building:buildingId,model:rule.model,runs:validRuns,agent:ALL_AGENTS.includes(agentId)\u0026\u0026validRuns!==`cursor`?agentId:null}};const[selection,setSelection]=useState({building:`platform`,model:`orchestrator`,runs:null,agent:null});useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);const matches=(wanted,current)=>{if(wanted===undefined||wanted===null)return true;const list=String(wanted).split(`,`).map(entry=>entry.trim()).filter(Boolean);return list.length===0||list.includes(current??`none`)};if(!matches(building,selection.building)||!matches(model,selection.model)||!matches(runs,selection.runs)||!matches(agent,selection.agent)){return null}return _jsx(_Fragment,{children})};const AgentVaultSetupSummary=()=>{const BUILDS={personal:`an agent you run manually`,scheduled:`a scheduled or unattended job`,platform:`a service that starts agents for tasks`};const RUNS={personal:[`container`,`server`],scheduled:[`container`,`ci`,`server`],platform:[`modal`,`daytona`,`e2b`,`kubernetes`,`container`,`cursor`,`server`]};const PLACES={server:`on a server or VM`,container:`in a container`,kubernetes:`on Kubernetes`,modal:`in Modal sandboxes`,daytona:`in Daytona sandboxes`,e2b:`in E2B sandboxes`,ci:`in a CI runner`};const AGENTS={\"claude-code\":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,hermes:`Hermes Agent`,openclaw:`OpenClaw`,custom:`your own agent`};const SELECTION_EVENT=`av-setup-selection-change`;const readSelection=()=>{const params=new URLSearchParams(window.location.search);const has=(object,key)=>Object.prototype.hasOwnProperty.call(object,key);const building=has(BUILDS,params.get(`building`))?params.get(`building`):`platform`;const runs=params.get(`runs`);const agent=params.get(`agent`);const validRuns=RUNS[building].includes(runs)?runs:null;return{building,runs:validRuns,agent:has(AGENTS,agent)\u0026\u0026validRuns!==`cursor`?agent:null}};const[selection,setSelection]=useState({building:`platform`,runs:null,agent:null});useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);const isCursor=selection.runs===`cursor`;let buildText=BUILDS[selection.building];if(isCursor){buildText=`a setup where Cursor Cloud Agents run their commands on your Kubernetes cluster`}else if(selection.runs){buildText=selection.building===`platform`?`a service that starts agents ${PLACES[selection.runs]} for each task`:selection.building===`personal`?`${buildText} ${PLACES[selection.runs]}`:`${buildText} that runs ${PLACES[selection.runs]}`}const agentText=selection.agent?`, using ${AGENTS[selection.agent]}`:``;const missing=[];if(!selection.runs)missing.push(`where the agent runs`);if(!selection.agent\u0026\u0026!isCursor)missing.push(`which agent you use`);return _jsxs(`p`,{children:[`You're building `,buildText,agentText,`.`,missing.length==0\u0026\u0026` Here's how the setup works:`,missing.length>0\u0026\u0026` Choose ${missing.join(` and `)} to fill in the rest of the setup.`]})};const AgentVaultSetupStep=({step,children})=>{const MODELS={personal:`user`,scheduled:`job`,platform:`orchestrator`};const CREATORS={user:`You`,job:`Infisical CLI`,orchestrator:`Orchestrator`};const SELECTION_EVENT=`av-setup-selection-change`;const readSelection=()=>{const params=new URLSearchParams(window.location.search);const building=params.get(`building`);const model=Object.prototype.hasOwnProperty.call(MODELS,building)?MODELS[building]:`orchestrator`;return{model,isCursor:model===`orchestrator`\u0026\u0026params.get(`runs`)===`cursor`}};const[{model,isCursor},setSelection]=useState({model:`orchestrator`,isCursor:false});useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);const creator=CREATORS[model];const STEPS={before:{},create:{number:1,title:{user:`You create a session`,job:`The CLI logs in and creates a session`,orchestrator:`The orchestrator creates a session for the task`}[model],route:`${creator} → Infisical`},token:{number:2,title:`Infisical returns a session token`,route:`Infisical → ${creator}`},start:{number:3,title:{user:`You start the agent with the token`,job:`The CLI starts the agent with the token`,orchestrator:isCursor?`The orchestrator starts a worker with the token`:`The orchestrator starts an agent with the token`}[model],route:`${creator} → Agent`},request:{number:4,title:`The agent sends an API request`,route:`Agent → API (intercepted by proxy)`},fetch:{number:5,title:`The proxy gets the session's credentials`,route:`Proxy → Infisical`},forward:{number:6,title:`The proxy sends the request with the real credential`,route:`Proxy → API`},revoke:{number:7,title:model===`orchestrator`?`The orchestrator revokes the session when the task ends`:`The CLI revokes the session when the agent exits`,route:`${creator} → Infisical`}};const current=STEPS[step];if(!current||step===`revoke`\u0026\u0026(model===`user`||isCursor))return null;return _jsxs(`section`,{className:`ifx-avsp__walk-step`,\"data-avsp-focus\":`step-${step}`,children:[_jsxs(`div`,{className:`ifx-avsp__walk-head not-prose`,children:[current.number?_jsx(`span`,{className:`ifx-avsp__walk-num`,children:current.number}):null,_jsxs(`div`,{children:[_jsx(`h3`,{className:`ifx-avsp__walk-title`,children:current.title}),current.route?_jsx(`p`,{className:`ifx-avsp__walk-route`,children:current.route}):null]})]}),_jsx(`div`,{className:`ifx-avsp__walk-body`,children})]})};const AgentVaultSetupDiagram=({inline,reveal})=>{const _components={a:`a`,..._provideComponents()};const RULES={personal:{model:`user`,runs:[`container`,`server`]},scheduled:{model:`job`,runs:[`container`,`ci`,`server`]},platform:{model:`orchestrator`,runs:[`modal`,`daytona`,`e2b`,`kubernetes`,`container`,`cursor`,`server`]}};const HOSTS={server:`Server or VM`,container:`Container`,kubernetes:`Kubernetes pod`,modal:`Modal sandbox`,daytona:`Daytona sandbox`,e2b:`E2B sandbox`,ci:`CI runner`,cursor:`Cursor worker pod`};const PER_AGENT_PROXY_RUNS=[`container`,`modal`,`daytona`];const FOCUS={building:{lanes:[`infisical`,`creator`],messages:[`create`,`token`,`start`,`revoke`]},runs:{lanes:[`agent`,`proxy`],messages:[`start`,`request`]},agent:{lanes:[`agent`],messages:[`start`,`request`]},\"step-before\":{lanes:[`infisical`,`proxy`],messages:[]}};const SELECTION_EVENT=`av-setup-selection-change`;const AGENT_IDS=[`claude-code`,`codex`,`opencode`,`hermes`,`openclaw`,`custom`];const readSelection=()=>{const params=new URLSearchParams(window.location.search);const building=Object.prototype.hasOwnProperty.call(RULES,params.get(`building`))?params.get(`building`):`platform`;const runs=params.get(`runs`);const agent=params.get(`agent`);const validRuns=RULES[building].runs.includes(runs)?runs:null;return{building,model:RULES[building].model,runs:validRuns,agent:AGENT_IDS.includes(agent)\u0026\u0026validRuns!==`cursor`?agent:null}};const[selection,setSelection]=useState({building:`platform`,model:`orchestrator`,runs:null,agent:null});const[focus,setFocus]=useState(null);const buildRef=useRef(null);const GUIDES=`/documentation/platform/agent-vault`;let buildHref=`#build-your-setup`;if(selection.model===`user`){const guide={\"claude-code\":`guides/claude-code`,codex:`guides/codex`,opencode:`guides/opencode`,hermes:`guides/hermes`,openclaw:`guides/openclaw`,custom:`guides/custom-agent`}[selection.agent];buildHref=`${GUIDES}/${guide??`quickstart`}`}useEffect(()=>{const link=buildRef.current;if(!link)return;const href=link.getAttribute(`href`)||``;const underDocs=window.location.pathname===`/docs`||window.location.pathname.startsWith(`/docs/`);if(underDocs\u0026\u0026href.startsWith(`/`)\u0026\u0026!href.startsWith(`/docs/`)){link.setAttribute(`href`,`/docs${href}`)}},[buildHref]);useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);let frame=0;const onScroll=()=>{cancelAnimationFrame(frame);frame=requestAnimationFrame(()=>{const line=window.innerHeight*.4;const sections=Array.from(document.querySelectorAll(`[data-avsp-focus]`));let current=null;sections.forEach(el=>{if(el.getBoundingClientRect().top\u003c=line)current=el});const last=sections[sections.length-1];if(current===last\u0026\u0026last.getBoundingClientRect().bottom\u003c=line)current=null;sections.forEach(el=>el.toggleAttribute(`data-avsp-active`,el===current));setFocus(current?current.getAttribute(`data-avsp-focus`):null)})};onScroll();window.addEventListener(`scroll`,onScroll,{passive:true});window.addEventListener(`resize`,onScroll);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync);window.removeEventListener(`scroll`,onScroll);window.removeEventListener(`resize`,onScroll);cancelAnimationFrame(frame)}},[]);const sharesHost=selection.model===`job`;const isCursor=selection.runs===`cursor`;const creator={user:{label:`Orchestrator`,sub:`You, in the dashboard`},job:{label:`Orchestrator`,sub:`Infisical CLI in your job`},orchestrator:{label:`Orchestrator`,sub:isCursor?`Your spawn hook`:`Your service`}}[selection.model];let proxyLayout=`single`;if(selection.model===`orchestrator`\u0026\u0026PER_AGENT_PROXY_RUNS.includes(selection.runs)){proxyLayout=`per-agent`}else if(selection.model!==`user`){proxyLayout=`shared`}const proxySub={single:`Its own host`,shared:`Shared by every agent`,\"per-agent\":`Separate container per agent`}[proxyLayout];const lanes=[{id:`infisical`,label:`Infisical`,sub:`Cloud or self-hosted`},{id:`creator`,label:creator.label,sub:creator.sub},{id:`agent`,label:proxyLayout===`shared`?`Agents`:`Agent`,sub:selection.runs?HOSTS[selection.runs]:`Agent's host`},{id:`proxy`,label:`Proxy`,sub:proxySub},{id:`api`,label:`API`,sub:`Such as GitHub`}];const laneIndex=id=>lanes.findIndex(lane=>lane.id===id);const messages=[{id:`create`,from:`creator`,to:`infisical`,label:{user:`Create a session`,job:`Log in and create a session`,orchestrator:`Create a session for the task`}[selection.model]},{id:`token`,from:`infisical`,to:`creator`,label:`Session token`,reply:true},{id:`start`,from:`creator`,to:`agent`,label:isCursor?`Start a worker with the token`:selection.model===`orchestrator`?`Start an agent with the token`:`Start the agent with the token`},{id:`request`,from:`agent`,to:`proxy`,label:`API request`,note:`(e.g. api.github.com)`,aimedAt:`api`},{id:`fetch`,from:`proxy`,to:`infisical`,label:`Get the session's credentials`},{id:`forward`,from:`proxy`,to:`api`,label:`Request with the real credential`}];if(selection.model===`job`){messages.push({id:`revoke`,from:`creator`,to:`infisical`,label:`Revoke the session when the agent exits`})}if(selection.model===`orchestrator`\u0026\u0026!isCursor){messages.push({id:`revoke`,from:`creator`,to:`infisical`,label:`Revoke the session when the task ends`})}const scrollToStep=id=>{const block=document.querySelector(`[data-avsp-focus=\"step-${id}\"]`);if(!block)return;const reduceMotion=window.matchMedia(`(prefers-reduced-motion: reduce)`).matches;block.scrollIntoView({behavior:reduceMotion?`auto`:`smooth`,block:`center`})};let highlight=null;if(focus){const stepMessage=messages.find(message=>`step-${message.id}`===focus);highlight=stepMessage?{lanes:[stepMessage.from,stepMessage.to],messages:[stepMessage.id]}:FOCUS[focus]??null}const stateClass=(base,active)=>{if(!highlight)return base;return active?`${base} ${base}--focus`:`${base} ${base}--dim`};let revealed=null;if(reveal){let stage=0;if(focus===null){stage=messages.length}else if(focus.startsWith(`step-`)\u0026\u0026focus!==`step-before`){stage=messages.findIndex(message=>`step-${message.id}`===focus)+1}const shown=messages.slice(0,stage);const current=focus\u0026\u0026focus.startsWith(`step-`)\u0026\u0026stage>0?shown[stage-1]:null;const shownLanes=new Set([`infisical`,`proxy`]);shown.forEach(message=>{shownLanes.add(message.from);shownLanes.add(message.to);if(message.aimedAt)shownLanes.add(message.aimedAt)});revealed={shown:new Set(shown.map(message=>message.id)),shownLanes,current}}const laneClass=id=>{if(!revealed)return stateClass(`ifx-avsp__lane`,highlight\u0026\u0026highlight.lanes.includes(id));if(!revealed.shownLanes.has(id))return`ifx-avsp__lane ifx-avsp__lane--hidden`;const focused=revealed.current?[revealed.current.from,revealed.current.to].includes(id):focus===`step-before`;return focused?`ifx-avsp__lane ifx-avsp__lane--focus`:`ifx-avsp__lane`};const messageClass=id=>{if(!revealed){return stateClass(`ifx-avsp__message`,highlight\u0026\u0026highlight.messages.includes(id))}if(!revealed.shown.has(id))return`ifx-avsp__message ifx-avsp__message--hidden`;if(!revealed.current)return`ifx-avsp__message`;return revealed.current.id===id?`ifx-avsp__message ifx-avsp__message--focus`:`ifx-avsp__message ifx-avsp__message--past`};const lifelineClass=id=>revealed\u0026\u0026!revealed.shownLanes.has(id)?`ifx-avsp__lifeline ifx-avsp__lifeline--hidden`:`ifx-avsp__lifeline`;const laneCount=lanes.length;const center=index=>`${(index+.5)/laneCount*100}%`;return _jsxs(`div`,{className:inline?`ifx-avsp__diagram-inline not-prose`:`not-prose`,children:[_jsx(`div`,{className:`ifx-avsp__panel-head`,children:_jsxs(_components.a,{ref:buildRef,href:buildHref,className:`ifx-btn ifx-btn--primary ifx-avsp__build-button`,children:[`Build`,_jsxs(`svg`,{width:`14`,height:`14`,viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,\"aria-hidden\":`true`,children:[_jsx(`path`,{d:`M5 12h14`}),_jsx(`path`,{d:`m12 5 7 7-7 7`})]})]})}),_jsx(`div`,{className:`ifx-avsp__diagram-scroll`,children:_jsxs(`div`,{className:`ifx-avsp__diagram`,role:`group`,\"aria-label\":`Setup diagram`,children:[_jsxs(`div`,{className:`ifx-avsp__lanes`,\"aria-hidden\":`true`,children:[sharesHost\u0026\u0026(!revealed||revealed.shownLanes.has(`creator`))\u0026\u0026_jsx(`div`,{className:`ifx-avsp__boundary`,children:_jsx(`span`,{className:`ifx-avsp__boundary-label`,children:`Same host`})}),proxyLayout===`per-agent`\u0026\u0026(!revealed||revealed.shownLanes.has(`agent`))\u0026\u0026_jsx(`div`,{className:`ifx-avsp__boundary ifx-avsp__boundary--per-agent`,children:_jsx(`span`,{className:`ifx-avsp__boundary-label`,children:`Created for each task`})}),lanes.map(lane=>_jsxs(`div`,{className:proxyLayout===`shared`\u0026\u0026lane.id===`agent`?`${laneClass(lane.id)} ifx-avsp__lane--stacked`:laneClass(lane.id),children:[_jsx(`span`,{className:`ifx-avsp__lane-label`,children:lane.label}),_jsx(`span`,{className:`ifx-avsp__lane-sub`,children:lane.sub})]},lane.id))]}),_jsxs(`div`,{className:`ifx-avsp__messages`,children:[lanes.map((lane,index)=>_jsx(`span`,{className:lifelineClass(lane.id),style:{left:center(index)},\"aria-hidden\":`true`},lane.id)),messages.map((message,index)=>{const from=laneIndex(message.from);const to=laneIndex(message.to);const start=Math.min(from,to);const span=Math.abs(to-from);const classes=[`ifx-avsp__arrow`];classes.push(to>from?`ifx-avsp__arrow--right`:`ifx-avsp__arrow--left`);if(message.reply)classes.push(`ifx-avsp__arrow--reply`);if(message.aimedAt)classes.push(`ifx-avsp__arrow--caught`);if(start===0)classes.push(`ifx-avsp__arrow--first-lane`);else if(start+span===laneCount-1)classes.push(`ifx-avsp__arrow--last-lane`);return _jsx(`div`,{className:`${messageClass(message.id)}${message.note?` ifx-avsp__message--noted`:``}`,children:_jsxs(`div`,{className:classes.join(` `),style:{left:center(start),width:`${span/laneCount*100}%`},children:[_jsxs(`span`,{className:`ifx-avsp__arrow-label`,children:[_jsx(`button`,{type:`button`,className:`ifx-avsp__arrow-num ifx-avsp__arrow-num--link`,\"aria-label\":`Go to step ${index+1}: ${message.label}`,onClick:()=>scrollToStep(message.id),children:index+1}),_jsx(`span`,{\"aria-hidden\":`true`,children:message.label})]}),message.note\u0026\u0026_jsx(`span`,{className:`ifx-avsp__arrow-note`,\"aria-hidden\":`true`,children:message.note}),message.aimedAt\u0026\u0026_jsxs(_Fragment,{children:[_jsx(`span`,{className:`ifx-avsp__arrow-catch`,\"aria-hidden\":`true`}),_jsx(`span`,{className:`ifx-avsp__arrow-aim`,style:{width:`calc(${(laneIndex(message.aimedAt)-to)/span*100}% - 4px)`},\"aria-hidden\":`true`})]})]})},message.id)})]})]})})]})};const AgentVaultSetupQuestions=()=>{const docsPath=typeof window===`undefined`?``:window.location.pathname;const docsBase=docsPath===`/docs`||docsPath.startsWith(`/docs/`)?`/docs`:``;const AGENT_IMG_BASE=`/images/agent-vault-agents`;const AGENT_IMAGES={\"claude-code\":{dark:`claude-code.svg`},codex:{light:`OpenAI.png`,dark:`OpenAIWhite.png`},hermes:{light:`hermes.png`,dark:`hermes.on-dark.png`},opencode:{light:`opencode.svg`,dark:`opencode.on-dark.svg`},openclaw:{dark:`openclaw.svg`}};const BUILDS=[{id:`platform`,label:`A service that starts agents for tasks`,example:`Your own code, such as a Slack bot or a backend service, that starts a new agent for each task.`,runs:[`modal`,`daytona`,`e2b`,`kubernetes`,`container`,`cursor`,`server`]},{id:`scheduled`,label:`A scheduled or unattended job`,example:`An agent that runs on a schedule or in CI, such as one that triages new issues.`,runs:[`container`,`ci`,`server`]},{id:`personal`,label:`An agent you run manually`,example:`You create a session in the Infisical dashboard and run the agent with its token, such as a coding agent on a dev box.`,runs:[`container`,`server`]}];const RUNS=[{id:`server`,label:`A server or VM`,example:`Such as a dev box, a cloud VM, or a home server.`},{id:`container`,label:`A container`,example:`Such as a Docker container or a dev container.`},{id:`kubernetes`,label:`Kubernetes`,example:`A pod in your own cluster.`},{id:`modal`,label:`Modal`,example:`Each task runs in its own Modal sandbox.`},{id:`daytona`,label:`Daytona`,example:`Each task runs in its own Daytona sandbox.`},{id:`e2b`,label:`E2B`,example:`Each task runs in its own E2B sandbox.`},{id:`ci`,label:`A CI runner`,example:`Such as a GitHub Actions job.`},{id:`cursor`,label:`Cursor Cloud Agents`,example:`Cursor runs the agent, and its commands run on your Kubernetes cluster.`}];const NO_AGENT_RUNS=[`cursor`];const RUN_LOGOS={modal:[{light:`agent-vault-agents/modal.svg`}],daytona:[{light:`agent-vault-agents/daytona.svg`,invertDark:true}],e2b:[{light:`agent-vault-agents/e2b.svg`}],kubernetes:[{light:`stack/kubernetes.png`}],container:[{light:`agent-vault-agents/docker.svg`}],ci:[{light:`agent-vault-templates/GitHub.on-light.png`,dark:`agent-vault-templates/GitHub.png`}],cursor:[{light:`agent-vault-agents/cursor.svg`}]};const AGENTS=[{id:`claude-code`,label:`Claude Code`},{id:`codex`,label:`Codex`},{id:`opencode`,label:`OpenCode`},{id:`hermes`,label:`Hermes Agent`},{id:`openclaw`,label:`OpenClaw`},{id:`custom`,label:`Your own agent`}];const SELECTION_EVENT=`av-setup-selection-change`;const readSelection=()=>{const params=new URLSearchParams(window.location.search);const build=BUILDS.find(option=>option.id===params.get(`building`))??BUILDS[0];const runs=RUNS.find(option=>option.id===params.get(`runs`));const agent=AGENTS.find(option=>option.id===params.get(`agent`));const runsId=runs\u0026\u0026build.runs.includes(runs.id)?runs.id:null;return{building:build.id,runs:runsId,agent:agent\u0026\u0026!NO_AGENT_RUNS.includes(runsId)?agent.id:null}};const[selection,setSelection]=useState({building:`platform`,runs:null,agent:null});useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);const choose=(dimension,value)=>{const toggledOff=dimension!==`building`\u0026\u0026selection[dimension]===value;const next={...selection,[dimension]:toggledOff?null:value};if(dimension===`building`){const build=BUILDS.find(option=>option.id===next.building);if(next.runs\u0026\u0026!build.runs.includes(next.runs))next.runs=null}if(NO_AGENT_RUNS.includes(next.runs))next.agent=null;const params=new URLSearchParams(window.location.search);[`building`,`runs`,`agent`].forEach(key=>{if(next[key])params.set(key,next[key]);else params.delete(key)});const query=params.toString();window.history.replaceState({},``,`${window.location.pathname}${query?`?${query}`:``}${window.location.hash}`);window.dispatchEvent(new Event(SELECTION_EVENT))};const activeBuild=BUILDS.find(option=>option.id===selection.building);const visibleRuns=activeBuild.runs.map(id=>RUNS.find(option=>option.id===id));const renderAgentIcon=id=>{if(id===`custom`){return _jsxs(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,\"aria-hidden\":`true`,children:[_jsx(`path`,{d:`m16 18 6-6-6-6`}),_jsx(`path`,{d:`m8 6-6 6 6 6`})]})}const image=AGENT_IMAGES[id];const src=file=>`${docsBase}${AGENT_IMG_BASE}/${encodeURIComponent(file)}`;const lightFile=image.light??image.dark;const darkFile=image.dark??image.light;if(lightFile===darkFile){return _jsx(`img`,{src:src(lightFile),alt:``,className:`ifx-avqs__img`})}return _jsxs(_Fragment,{children:[_jsx(`img`,{src:src(lightFile),alt:``,className:`ifx-avqs__img ifx-avqs__img--light-only`}),_jsx(`img`,{src:src(darkFile),alt:``,className:`ifx-avqs__img ifx-avqs__img--dark-only`})]})};const renderOption=(dimension,option,children)=>{const active=selection[dimension]===option.id;return _jsx(`button`,{type:`button`,\"aria-pressed\":active,className:active?`ifx-avsp__card ifx-avsp__card--active`:`ifx-avsp__card`,onClick:()=>choose(dimension,option.id),children},option.id)};return _jsxs(`div`,{className:`ifx-avsp__questions not-prose`,children:[_jsxs(`section`,{className:`ifx-avsp__step`,\"data-avsp-focus\":`building`,children:[_jsx(`h2`,{className:`ifx-avsp__step-title`,children:`What are you building?`}),_jsx(`p`,{className:`ifx-avsp__step-desc`,children:`Your answer decides who creates each session and how long each session lasts.`}),_jsx(`div`,{className:`ifx-avsp__cards`,children:BUILDS.map(option=>renderOption(`building`,option,_jsxs(_Fragment,{children:[_jsx(`span`,{className:`ifx-avsp__card-label`,children:option.label}),_jsx(`span`,{className:`ifx-avsp__card-desc`,children:option.example})]})))})]}),_jsxs(`section`,{className:`ifx-avsp__step`,\"data-avsp-focus\":`runs`,children:[_jsx(`h2`,{className:`ifx-avsp__step-title`,children:activeBuild.id===`platform`?`Where do the agents run?`:`Where does the agent run?`}),_jsx(`p`,{className:`ifx-avsp__step-desc`,children:`Your answer decides where to run the proxy and how the agent starts.`}),_jsx(`div`,{className:`ifx-avsp__cards`,children:visibleRuns.map(option=>renderOption(`runs`,option,_jsxs(`span`,{className:`ifx-avsp__card-row`,children:[_jsxs(`span`,{className:`ifx-avsp__card-text`,children:[_jsx(`span`,{className:`ifx-avsp__card-label`,children:option.label}),_jsx(`span`,{className:`ifx-avsp__card-desc`,children:option.example})]}),RUN_LOGOS[option.id]\u0026\u0026_jsx(`span`,{className:`ifx-avsp__card-logos`,children:RUN_LOGOS[option.id].map(logo=>{const src=file=>`${docsBase}/images/${file}`;const invert=logo.invertDark?` ifx-avsp__card-logo--invert-dark`:``;if(!logo.dark){return _jsx(`img`,{src:src(logo.light),alt:``,className:`ifx-avsp__card-logo${invert}`},logo.light)}return _jsxs(`span`,{className:`ifx-avsp__card-logo-pair`,children:[_jsx(`img`,{src:src(logo.light),alt:``,className:`ifx-avsp__card-logo ifx-avqs__img--light-only`}),_jsx(`img`,{src:src(logo.dark),alt:``,className:`ifx-avsp__card-logo ifx-avqs__img--dark-only`})]},logo.light)})})]})))})]}),!NO_AGENT_RUNS.includes(selection.runs)\u0026\u0026_jsxs(`section`,{className:`ifx-avsp__step`,\"data-avsp-focus\":`agent`,children:[_jsx(`h2`,{className:`ifx-avsp__step-title`,children:`Which agent?`}),_jsx(`p`,{className:`ifx-avsp__step-desc`,children:`Your answer decides which guide to follow and which command starts the agent.`}),_jsx(`div`,{className:`ifx-avsp__cards`,children:AGENTS.map(option=>renderOption(`agent`,option,_jsxs(`span`,{className:`ifx-avsp__card-agent`,children:[_jsx(`span`,{className:`ifx-avsp__card-icon`,children:renderAgentIcon(option.id)}),_jsx(`span`,{className:`ifx-avsp__card-label`,children:option.label})]})))})]})]})};const AgentVaultSetupLayout=({aside,children})=>_jsxs(`div`,{className:`ifx-avsp__layout`,children:[_jsx(`div`,{className:`ifx-avsp__content`,children}),_jsx(`aside`,{className:`ifx-avsp__aside`,children:_jsx(`div`,{className:`ifx-avsp__aside-inner`,children:aside})})]});const AgentVaultSetupPage=({eyebrow,title,description,children})=>{const rootRef=useRef(null);useEffect(()=>{const navbar=document.getElementById(`navbar`);if(rootRef.current\u0026\u0026navbar){rootRef.current.style.setProperty(`--avsp-top`,`${Math.round(navbar.getBoundingClientRect().height)}px`)}},[]);return _jsxs(`div`,{className:`ifx-avsp`,ref:rootRef,children:[_jsxs(`header`,{className:`ifx-avsp__hero`,children:[eyebrow?_jsx(`div`,{className:`ifx-avsp__eyebrow`,children:eyebrow}):null,_jsx(`h1`,{className:`ifx-avsp__title`,children:title}),description?_jsx(`div`,{className:`ifx-avsp__description`,children:description}):null]}),_jsx(`div`,{className:`ifx-avsp__body prose dark:prose-invert`,children})]})};function _createMdxContent(props){const _components={a:`a`,code:`code`,h2:`h2`,p:`p`,strong:`strong`,..._provideComponents(),...props.components},{Note,Tip,_MdxComponentBoundary}=_components;if(!Note)_missingMdxReference(`Note`,true);if(!Tip)_missingMdxReference(`Tip`,true);if(!_MdxComponentBoundary)_missingMdxReference(`_MdxComponentBoundary`,true);return _jsx(_MdxComponentBoundary,{name:`AgentVaultSetupPage`,children:_jsxs(AgentVaultSetupPage,{eyebrow:`Get started`,title:`Plan your Agent Vault setup`,description:`Get a recommended Agent Vault setup for what you're building.`,children:[_jsx(_components.p,{children:`Configure the following options to get custom guidance and best practices tailored to your agent’s setup.`}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupLayout`,children:_jsxs(AgentVaultSetupLayout,{aside:_jsx(AgentVaultSetupDiagram,{}),children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupQuestions`,children:_jsx(AgentVaultSetupQuestions,{})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupDiagram`,children:_jsx(AgentVaultSetupDiagram,{inline:true})})]})}),_jsx(_components.h2,{children:`Your setup`}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupSummary`,children:_jsx(AgentVaultSetupSummary,{})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupLayout`,children:_jsxs(AgentVaultSetupLayout,{aside:_jsx(AgentVaultSetupDiagram,{reveal:true}),children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`before`,children:[_jsx(_components.p,{children:`Before running an agent, you set up two things:`}),_jsxs(`ul`,{children:[_jsxs(`li`,{children:[`An `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/access-bundles`,children:`access bundle`}),` in an `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/projects`,children:`Agent Vault project`}),`: a list of the `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/services`,children:`services`}),` (the external APIs or MCP servers) that the agent can use, each with its real credential`]}),_jsxs(`li`,{children:[`A running `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies`,children:`proxy`}),`: a program outside the agent’s environment that every request from the agent goes through`]})]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsx(Note,{children:_jsx(_components.p,{children:`One proxy stays running and handles the requests from every agent and every job in its Agent Vault project, so you don’t need a separate proxy for each job or each host. If you have more than one project, each project needs its own proxy.`})})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`none,server,kubernetes,e2b,cursor`,children:_jsx(Note,{children:_jsx(_components.p,{children:`One proxy stays running and handles the requests from every agent in its Agent Vault project, so you don’t need a separate proxy for each task.`})})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`container,modal,daytona`,children:_jsx(Note,{children:_jsx(_components.p,{children:`Each agent run starts its own proxy beside the agent. Every proxy starts from the same proxy token, so you create the proxy in your Agent Vault project once.`})})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`create`,children:[_jsxs(_components.p,{children:[`A `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions`,children:`session`}),` gives an agent access to the services in one access bundle, until the session expires or someone `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions#revoke-a-session`,children:`revokes it`}),`.`]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,children:_jsxs(_components.p,{children:[`You `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions#create-a-session`,children:`create the session in the Infisical dashboard`}),` and choose when it expires. If the agent keeps running, such as a chat assistant, set the session to never expire.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsxs(_components.p,{children:[`Each time the job runs, the `,_jsx(_components.a,{href:`/cli/overview`,children:`Infisical CLI`}),` logs in as a `,_jsx(_components.a,{href:`/documentation/platform/identities/machine-identities`,children:`machine identity`}),` and creates a session. `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli#choose-how-long-each-session-lasts`,children:`Each session lasts`}),` a little longer than the longest run you expect, because the agent loses access to the APIs if a run outlasts its session.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsxs(_components.p,{children:[`For each task, the `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/how-it-works#orchestrators`,children:`orchestrator`}),` logs in as a `,_jsx(_components.a,{href:`/documentation/platform/identities/machine-identities`,children:`machine identity`}),` and creates a session through the `,_jsx(_components.a,{href:`/api-reference/endpoints/agent-vault-sessions/create`,children:`Infisical API`}),`. Each kind of task has its own access bundle, and the orchestrator chooses the access bundle when it creates the session.`]})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`token`,children:[_jsx(_components.p,{children:`The session token only works for the services in the session’s access bundle, and only until the session expires or is revoked.`}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,children:_jsx(_components.p,{children:`The dashboard shows the token in a command that starts the agent with it. If the session never expires, revoking the session is what stops the agent from using the real credentials.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsx(_components.p,{children:`The CLI keeps the token and passes it to the agent in the next step, so you never handle the token yourself.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsx(_components.p,{children:`The orchestrator receives the token in the API response.`})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`start`,children:[_jsx(_components.p,{children:`The agent gets the session token instead of real API keys.`}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{runs:`none,server,container,kubernetes,modal,daytona,ci`,children:_jsxs(_components.p,{children:[_jsx(_components.a,{href:`/cli/reference#agent-vault-run`,children:_jsx(_components.code,{children:`infisical agent-vault run`})}),` starts the agent with its requests set to go through the proxy.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`cursor`,children:_jsx(_components.p,{children:`Cursor’s worker controller runs your spawn hook, which starts a worker pod with the session token. The worker sends the agent’s commands through the proxy, while the worker itself connects to Cursor directly.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,children:_jsx(_components.p,{children:`You run the command from the dashboard on the agent’s host.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsxs(AgentVaultSetupBranch,{building:`scheduled`,children:[_jsxs(_components.p,{children:[`The CLI starts the agent right after it creates the session. The agent can read the machine identity’s credentials `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli#step-2-start-the-agent`,children:`from its environment`}),`, and could use them to create a session for any access bundle the machine identity has. That’s why the machine identity only has the access bundle that this agent uses.`]}),_jsx(Tip,{children:_jsxs(_components.p,{children:[`To keep the machine identity’s credentials off the agent’s host, choose `,_jsx(_components.strong,{children:`A service that starts agents for tasks`}),` instead, where the orchestrator gives the agent only the session token.`]})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`none,server`,children:_jsx(_components.p,{children:`The orchestrator starts the agent on a different host and passes it only the session token.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`container`,children:_jsx(_components.p,{children:`The orchestrator creates a new container for the task, starts the agent in it, and passes it only the session token.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`kubernetes`,children:_jsx(_components.p,{children:`The orchestrator creates a new pod for the task, starts the agent in it, and passes it only the session token.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`modal,daytona`,children:_jsx(_components.p,{children:`The orchestrator creates a new sandbox for the task, starts the agent in it, and passes it only the session token.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`e2b`,children:_jsxs(_components.p,{children:[`The orchestrator creates a new E2B sandbox for the task, gives E2B the session token as the proxy’s password, and starts the agent in the sandbox. E2B holds the token on its servers, so the agent can’t read it and doesn’t need `,_jsx(_components.code,{children:`infisical agent-vault run`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsx(_components.p,{children:`The orchestrator stays out of the agent’s environment because the machine identity it uses can create sessions for every access bundle it’s granted. If an agent read those credentials, it could reach every service in those access bundles.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`claude-code`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so Claude Code runs in its `,_jsx(_components.a,{href:`https://code.claude.com/docs/en/headless`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`claude -p \"\u003cprompt>\"`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`codex`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so Codex runs in its `,_jsx(_components.a,{href:`https://developers.openai.com/codex/noninteractive`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`codex exec \"\u003cprompt>\"`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`opencode`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so OpenCode runs in its `,_jsx(_components.a,{href:`https://opencode.ai/docs/cli/#run-1`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`opencode run \"\u003cprompt>\"`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsxs(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`hermes`,children:[_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so Hermes runs in its `,_jsx(_components.a,{href:`https://hermes-agent.nousresearch.com/docs/user-guide/cli`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`hermes chat -q \"\u003cprompt>\"`}),`.`]}),_jsxs(Note,{children:[` Hermes won’t start without the API keys in `,_jsx(_components.code,{children:`~/.hermes/.env`}),`, so that file holds `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/hermes#step-2-launch-your-agent`,children:`placeholder values`}),`, and the proxy attaches the real keys.`]})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`openclaw`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so OpenClaw runs in its `,_jsx(_components.a,{href:`https://docs.openclaw.ai/cli/agent`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`openclaw agent --agent \u003cagent-id> --message \"\u003cprompt>\" --local`}),`. OpenClaw holds a `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/openclaw#step-2-launch-your-agent`,children:`placeholder`}),` instead of your model provider’s key, and the proxy attaches the real key.`]})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`request`,children:[_jsx(_components.p,{children:`The agent calls an API the same way it always does, but the request is intercepted by the proxy.`}),_jsxs(`ul`,{children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,scheduled`,runs:`container`,children:_jsx(`li`,{children:`The agents’ containers can’t read the proxy token`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{runs:`ci`,children:_jsxs(`li`,{children:[`The CI runner has to reach the proxy, so if the proxy is on a private network, the job runs on a `,_jsx(_components.a,{href:`https://docs.github.com/en/actions/hosting-your-own-runners`,children:`self-hosted runner`}),` in that network`]})})})]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,scheduled`,children:_jsx(Note,{children:_jsxs(_components.p,{children:[`The proxy `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#choose-where-to-run-the-proxy`,children:`runs on a different machine`}),` from the agent, on the same private network. If the proxy ran on the agent’s machine, the agent could read the proxy token.`]})})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`none,server`,children:_jsx(Note,{children:_jsxs(_components.p,{children:[`The proxy `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#choose-where-to-run-the-proxy`,children:`runs on a different machine`}),` from the agent, on the same private network. If the proxy ran on the agent’s machine, the agent could read the proxy token.`]})})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`container,kubernetes,modal,daytona`,children:_jsx(Note,{children:_jsx(_components.p,{children:`The proxy runs outside the agent’s environment, and the agent’s network only reaches the proxy. The agent can’t read the proxy token or connect to an API without going through the proxy.`})})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`e2b`,children:_jsx(Note,{children:_jsx(_components.p,{children:`E2B sends the sandbox’s connections to the proxy from its own servers, so the proxy runs on a public machine with its SOCKS5 port turned on. Nothing in the sandbox is set up to use the proxy, and the agent can’t send traffic that skips it.`})})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`cursor`,children:_jsx(Note,{children:_jsxs(_components.p,{children:[`The proxy runs in its own namespace, and workers can’t read the proxy token. Each worker needs a direct connection to Cursor, so the agent’s commands can still reach other public hosts unless you `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/cursor#workers%E2%80%99-outgoing-connections`,children:`limit where workers connect`}),`.`]})})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsx(AgentVaultSetupStep,{step:`fetch`,children:_jsxs(_components.p,{children:[`The credentials go from Infisical to the proxy, never to the agent. The proxy checks Infisical for updated values every `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#poll-interval`,children:`poll interval`}),` (60 seconds by default).`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`forward`,children:[_jsxs(_components.p,{children:[`The `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/http-apis#credential-types`,children:`real credential`}),` is added to the request at the proxy, so it never passes through the agent. The request appears in the session’s `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/session-logs`,children:`logs`}),`.`]}),_jsxs(_components.p,{children:[`The proxy only attaches credentials for the services in the access bundle. Requests to any other host go out without a credential, unless the proxy’s `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#traffic-policy`,children:`traffic policy`}),` blocks them.`]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`cursor`,children:_jsxs(_components.p,{children:[`Cursor doesn’t report when a worker exits, so the session lasts until its `,_jsx(_components.code,{children:`ttl`}),` runs out; `,_jsxs(_components.a,{href:`/documentation/platform/agent-vault/guides/cursor#sessions-that-outlive-their-workers`,children:[`keep the `,_jsx(_components.code,{children:`ttl`}),` as short as your runs allow`]}),`.`]})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`revoke`,children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsxs(_components.p,{children:[`From then on, the session token stops working. If the machine shuts down before the CLI can revoke the session, the session keeps working until its `,_jsx(_components.code,{children:`--ttl`}),` runs out.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsxs(_components.p,{children:[`The orchestrator revokes the session through the `,_jsx(_components.a,{href:`/api-reference/endpoints/agent-vault-sessions/revoke`,children:`Infisical API`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`container,kubernetes,modal,daytona,e2b`,children:_jsx(_components.p,{children:`The orchestrator also deletes the agent’s environment, so nothing from one task carries over to the next.`})})})]})})]})}),_jsx(`div`,{id:`build-your-setup`,className:`ifx-avsp__anchor`}),_jsx(_components.h2,{children:`Build your setup`}),_jsx(_components.p,{children:`Follow these pages in order:`}),_jsxs(`ol`,{children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`none`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/quickstart`,children:`Quickstart`}),`: create an access bundle with a service for each API the agent calls, then follow the guide for where your agent runs`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`claude-code,codex,opencode,hermes,openclaw,custom`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/quickstart`,children:`Quickstart`}),`: create an access bundle with a service for each key the agent uses`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`claude-code`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/claude-code`,children:`Agent Vault with Claude Code`}),`: create a proxy, create a session, and start Claude Code with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`codex`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/codex`,children:`Agent Vault with Codex`}),`: create a proxy, create a session, and start Codex with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`opencode`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/opencode`,children:`Agent Vault with OpenCode`}),`: create a proxy, create a session, and start OpenCode with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`hermes`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/hermes`,children:`Agent Vault with Hermes Agent`}),` to start Hermes in your terminal, or `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/hermes-gateway`,children:`Agent Vault with the Hermes gateway`}),` to keep Hermes running and answering messages: create a proxy, create a session, and start Hermes with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`openclaw`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/openclaw`,children:`Agent Vault with OpenClaw`}),` to start OpenClaw in your terminal, or `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/openclaw-gateway`,children:`Agent Vault with the OpenClaw gateway`}),` to keep OpenClaw running and answering messages: create a proxy, create a session, and start OpenClaw with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`custom`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/custom-agent`,children:`Connect your own agent`}),`: create a proxy, create a session, and send your agent’s requests through the proxy`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/quickstart`,children:`Quickstart`}),`: create an access bundle with a service for each external system the agent uses`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#create-a-proxy-and-start-it`,children:`Create a proxy`}),`, and run it with Docker, Kubernetes, or systemd so that it keeps running between jobs`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`none,server`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#create-a-proxy-and-start-it`,children:`Create a proxy`}),`, and run it with Docker, Kubernetes, or systemd so that it keeps running between tasks`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`container`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/docker`,children:`Run agents in Docker containers with Agent Vault`}),`: create a session for each task, then start the agent in its own container with a proxy beside it`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsxs(AgentVaultSetupBranch,{building:`platform`,runs:`kubernetes`,children:[_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/kubernetes`,children:`Run agents on Kubernetes with Agent Vault`}),`: choose an isolation level for agent pods`]}),_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/kubernetes-setup`,children:`Set up Agent Vault on Kubernetes`}),`: deploy the proxy in its own namespace, limit agent pods to it, and start each agent with its own session`]})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`modal`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/modal`,children:`Run agents in Modal sandboxes with Agent Vault`}),`: create a session for each task, then start the agent in its own sandbox with a proxy beside it`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`daytona`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/daytona`,children:`Run agents in Daytona sandboxes with Agent Vault`}),`: create a session for each task, then start the agent in its own sandbox with a proxy beside it`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`e2b`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/e2b`,children:`Run agents in E2B sandboxes with Agent Vault`}),`: run one proxy on a public machine with its SOCKS5 port turned on, then create a session for each task and give its token to E2B as the proxy’s password`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,runs:`none,server`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli`,children:`Create sessions with the CLI`}),`: set up a machine identity, then run the agent from cron or systemd`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,runs:`container`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli`,children:`Create sessions with the CLI`}),`: set up a machine identity, then start the agent from the container’s entrypoint`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,runs:`ci`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli`,children:`Create sessions with the CLI`}),`: set up a machine identity, then start the agent in a GitHub Actions step`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`none,server`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-api`,children:`Create sessions with the API`}),`: set up a machine identity for the orchestrator, then create a session for each task and revoke it when the task ends`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`none,server`,agent:`none,claude-code,codex,opencode,hermes,openclaw`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-api#step-4-start-the-agent-with-the-session-token`,children:`Start each agent with its session token`}),`: install the Infisical CLI on each agent’s host, and start the agent with `,_jsx(_components.code,{children:`infisical agent-vault run --session-token`})]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`custom`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/custom-agent#step-4-send-requests-through-the-proxy`,children:`Send your agent’s requests through the proxy`}),`: set the proxy and the proxy’s certificate in your agent’s HTTP client`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,runs:`cursor`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/cursor`,children:`Run Cursor Cloud Agents on Kubernetes with Agent Vault`}),`: deploy the proxy, then add a spawn hook that creates a session for each run and starts its worker with the session token`]})})})]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,children:_jsx(Note,{children:_jsxs(_components.p,{children:[`If the agent keeps running, such as a chat assistant, set `,_jsx(_components.strong,{children:`Expires`}),` to `,_jsx(_components.strong,{children:`Never`}),` when the guide has you create a session. If the session expires, the agent loses access to the APIs.`]})})})})]})})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{AgentVaultSetupBranch,AgentVaultSetupSummary,AgentVaultSetupStep,AgentVaultSetupDiagram,AgentVaultSetupQuestions,AgentVaultSetupLayout,AgentVaultSetupPage,default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"codeStyling":"dark","config":{},"pageMetadata":{"title":"Plan your Agent Vault setup","sidebarTitle":"Plan your setup","description":"Get a recommended Agent Vault setup for what you're building.","mode":"frame","href":"/documentation/platform/agent-vault/plan-your-setup"}}},"mdxSourceWithNoJs":null,"noJsSplices":[[19,38,""],[157,26211,")=>null;const AgentVaultSetupSummary=()=>null;const AgentVaultSetupStep=()=>null;const AgentVaultSetupDiagram=()=>null;const AgentVaultSetupQuestions=()=>null;const AgentVaultSetupLayout=()=>null;const AgentVaultSetupPage=()=>null;function "]]},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/docs/_mintlify/custom/infisical/b13a5df316344f52/unify.js","/docs/_mintlify/custom/infisical/bc9046d1d11b5448/field-name-copy.js","/docs/_mintlify/custom/infisical/fdfdc80c034be768/cli-reference-nav.js"],"subdomain":"infisical","siteName":"Infisical","title":"Plan your Agent Vault setup - Infisical","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-11-05T23:37:46.723Z","originalFileLocation":"documentation/platform/agent-vault/plan-your-setup.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"light\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Get a recommended Agent Vault setup for what you\u0026#x27;re building.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Infisical\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/x-icon\" sizes=\"180x180\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"icon\" type=\"image/x-icon\" sizes=\"32x32\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"icon\" type=\"image/x-icon\" sizes=\"16x16\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003cmeta data-mint-head property=\"og:title\" content=\"Plan your Agent Vault setup - Infisical\">\u003cmeta data-mint-head property=\"og:description\" content=\"Get a recommended Agent Vault setup for what you\u0026#x27;re building.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Infisical\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://infisical.mintlify.site/docs/_mintlify/api/og/v2?division=Get+started\u0026amp;title=Plan+your+Agent+Vault+setup\u0026amp;description=Get+a+recommended+Agent+Vault+setup+for+what+you%27re+building.\u0026amp;theme=48a50df3ba2e68203e367e83\u0026amp;signature=061adcd83741af2d6a81308e67746201d4faae6139091ea9dd769b510a8ebed6\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Plan your Agent Vault setup - Infisical\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Get a recommended Agent Vault setup for what you\u0026#x27;re building.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://infisical.mintlify.site/docs/_mintlify/api/og/v2?division=Get+started\u0026amp;title=Plan+your+Agent+Vault+setup\u0026amp;description=Get+a+recommended+Agent+Vault+setup+for+what+you%27re+building.\u0026amp;theme=48a50df3ba2e68203e367e83\u0026amp;signature=061adcd83741af2d6a81308e67746201d4faae6139091ea9dd769b510a8ebed6\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/_generated/favicon/browserconfig.xml?v=3\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Infisical\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#26272b\">\u003clink data-mint-head rel=\"canonical\" href=\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/docs/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/documentation/platform/agent-vault/plan-your-setup.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://infisical.com/#organization\",\"name\":\"Infisical\",\"url\":\"https://infisical.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/light.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://infisical.com/docs#website\",\"name\":\"Infisical\",\"url\":\"https://infisical.com/docs\",\"publisher\":{\"@id\":\"https://infisical.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#webpage\",\"url\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\",\"name\":\"Plan your Agent Vault setup\",\"description\":\"Get a recommended Agent Vault setup for what you're building.\",\"dateModified\":\"2026-11-05T23:37:46.723Z\",\"isPartOf\":{\"@id\":\"https://infisical.com/docs#website\"},\"breadcrumb\":{\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Get started\",\"item\":\"https://infisical.com/docs/documentation/platform/agent-vault/quickstart\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Plan your Agent Vault setup\",\"item\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#article\",\"headline\":\"Plan your Agent Vault setup\",\"name\":\"Plan your Agent Vault setup\",\"description\":\"Get a recommended Agent Vault setup for what you're building.\",\"url\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\",\"mainEntityOfPage\":{\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#webpage\"},\"dateModified\":\"2026-11-05T23:37:46.723Z\",\"publisher\":{\"@id\":\"https://infisical.com/#organization\"},\"isPartOf\":{\"@id\":\"https://infisical.com/docs#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Infisical\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Infisical","nav":{"global":null,"tabs":[{"tab":"Get started","pages":[{"title":"Get started","href":"/documentation/getting-started/overview"}]},{"tab":"Products","menu":[{"item":"Secrets Management","icon":"key","pages":[{"title":"Secrets Management","href":"/documentation/platform/secrets-mgmt/overview"}]},{"item":"Certificate Management","icon":"file-key","pages":[{"title":"Certificate Management","href":"/documentation/platform/pki/overview"}]},{"item":"Privileged Access Management (PAM)","icon":"users","pages":[{"title":"Privileged Access Management (PAM)","href":"/documentation/platform/pam/overview"}]},{"item":"Agent Vault","icon":"vault","pages":[{"title":"Agent Vault","sidebarTitle":"Agent Vault","icon":"vault","href":"/documentation/platform/agent-vault/overview"},{"group":"Get started","pages":[{"title":"Add your credentials to Agent Vault","sidebarTitle":"Quickstart","href":"/documentation/platform/agent-vault/quickstart"},{"title":"Why use Agent Vault?","href":"/documentation/platform/agent-vault/why-agent-vault"},{"title":"How Agent Vault works","sidebarTitle":"How it works","description":"The pieces of an Agent Vault setup and how a session gives an agent access to APIs and MCP servers.","href":"/documentation/platform/agent-vault/how-it-works"},{"title":"Plan your Agent Vault setup","sidebarTitle":"Plan your setup","mode":"frame","href":"/documentation/platform/agent-vault/plan-your-setup"}]},{"group":"Guides","pages":[{"title":"Run agents in Modal sandboxes with Agent Vault","sidebarTitle":"Modal","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/modal.svg","description":"Run an Agent Vault proxy in each Modal sandbox so the agent never has access to a credential.","href":"/documentation/platform/agent-vault/guides/modal"},{"title":"Run agents in Daytona sandboxes with Agent Vault","sidebarTitle":"Daytona","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/daytona.svg","href":"/documentation/platform/agent-vault/guides/daytona"},{"title":"Run agents in E2B sandboxes with Agent Vault","sidebarTitle":"E2B","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/e2b.svg","href":"/documentation/platform/agent-vault/guides/e2b"},{"group":"Kubernetes","icon":"/images/stack/kubernetes.png","root":{"title":"Run agents on Kubernetes with Agent Vault","sidebarTitle":"Kubernetes","href":"/documentation/platform/agent-vault/guides/kubernetes"},"pages":[{"title":"Set up Agent Vault on Kubernetes","sidebarTitle":"Setup","href":"/documentation/platform/agent-vault/guides/kubernetes-setup"}]},{"title":"Run agents in Docker containers with Agent Vault","sidebarTitle":"Docker","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/docker.svg","href":"/documentation/platform/agent-vault/guides/docker"},{"title":"Run Cursor Cloud Agents on Kubernetes with Agent Vault","sidebarTitle":"Cursor Cloud Agents","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/cursor.svg","href":"/documentation/platform/agent-vault/guides/cursor"}]},{"group":"Concepts","pages":[{"title":"Agent Vault projects","sidebarTitle":"Projects","href":"/documentation/platform/agent-vault/projects"},{"title":"Access bundles","href":"/documentation/platform/agent-vault/access-bundles"},{"group":"Services","root":{"title":"Services","href":"/documentation/platform/agent-vault/services"},"pages":[{"title":"HTTP APIs","href":"/documentation/platform/agent-vault/http-apis"},{"title":"MCP servers","href":"/documentation/platform/agent-vault/mcp-servers"}]},{"title":"Variables","href":"/documentation/platform/agent-vault/variables"},{"title":"Skills","href":"/documentation/platform/agent-vault/skills"},{"group":"Sessions","root":{"title":"Sessions","href":"/documentation/platform/agent-vault/sessions"},"pages":[{"title":"Create Agent Vault sessions with the CLI","sidebarTitle":"Create sessions with the CLI","href":"/documentation/platform/agent-vault/sessions-cli"},{"title":"Create Agent Vault sessions with the API","sidebarTitle":"Create sessions with the API","href":"/documentation/platform/agent-vault/sessions-api"},{"title":"Sessions on behalf of users","href":"/documentation/platform/agent-vault/sessions-on-behalf-of-users"},{"title":"Inline services","href":"/documentation/platform/agent-vault/inline-services"},{"title":"Session logs","sidebarTitle":"Logs","href":"/documentation/platform/agent-vault/session-logs"}]},{"title":"Proxies","href":"/documentation/platform/agent-vault/proxies"},{"title":"Access control","href":"/documentation/platform/agent-vault/access-control"}]}]},{"item":"Key Management Service (KMS)","icon":"lock","pages":[{"title":"Key Management Service (KMS)","href":"/documentation/platform/kms/overview"}]},{"item":"Secret Scanning","icon":"radar","pages":[{"title":"Secret Scanning","href":"/documentation/platform/secret-scanning/overview"}]}]},{"tab":"Platform","menu":[{"item":"Organizations","icon":"building","pages":[{"title":"Organizations","href":"/documentation/platform/organization"}]},{"item":"Identity and access","icon":"id-card","pages":[{"title":"Identity and access","href":"/documentation/platform/identities/overview"}]},{"item":"App connections","icon":"plug","pages":[{"title":"App connections","href":"/integrations/app-connections/overview"}]},{"item":"Networking","icon":"network","pages":[{"title":"Networking","href":"/documentation/platform/gateways/overview"}]},{"item":"Self-hosting","icon":"server","pages":[{"title":"Self-hosting","href":"/self-hosting/overview"}]},{"item":"Internals","icon":"workflow","pages":[{"title":"Internals","href":"/internals/overview"}]},{"item":"Contributing","icon":"git-pull-request","pages":[{"title":"Contributing","href":"/contributing/getting-started/overview"}]}],"pages":[{"title":"Platform","href":"/documentation/platform/organization"}]},{"tab":"Reference","icon":{"name":"code","library":"lucide"},"menu":[{"item":"CLI","icon":"terminal","pages":[{"title":"CLI","href":"/cli/overview"}]},{"item":"API","icon":"book-open","pages":[{"title":"API","href":"/api-reference/overview/introduction"}]},{"item":"SDKs","icon":"boxes","pages":[{"title":"SDKs","href":"/sdks/overview"}]}],"pages":[{"title":"Reference","href":"/cli/overview"}]}]},"basePath":"","title":"Plan your Agent Vault setup - Infisical","buildId":"dpl_ATnXPMW25DMPUr9VBw6kL6MfBt6T","deploymentId":"dpl_ATnXPMW25DMPUr9VBw6kL6MfBt6T","dynamics":[],"chunks":[]}
