Add your credentials to Agent Vault

Store your credentials in an access bundle and connect the agents that use them.

This quickstart walks you through the setup shared by every Agent Vault workflow. You’ll create an Agent Vault project, create an access bundle, add a service for each key your agent uses, and then continue with the guide for where your agent runs.

​

Prerequisites

• An Infisical organization where you can create projects (organization admins and members can by default)
• The API keys your agent uses, such as its model provider’s key

​

Step 1: Create an Agent Vault project

An Agent Vault project holds the credentials, members, and proxies for one agentic system or team. If you already have a project for this agent, such as My first project, open it and skip to Step 2.

1. On your organization’s overview in Infisical, select Agent Vault.

2. Select New Project, enter a Project Name, then select Create Project.

   

You become the project’s admin.

​

Step 2: Add your credentials

Infisical dashboard

​

Create an access bundle

In Agent Vault, an access bundle defines the services your agents can reach. To create an access bundle:

1. In your Agent Vault project, go to Access Bundles.

2. Select Create Access Bundle. Give the access bundle a Name, such as code-review, then select Create Access Bundle.

   

​

Add a service

Next, add a service for each key your agent uses.

What services do I need?

• Its model provider’s API key, such as ANTHROPIC_API_KEY, if the agent uses one
• Each API it calls, such as GitHub
• For a messaging gateway, the platform’s token (see the keys that Hermes or OpenClaw uses)
• Each remote MCP server it connects to, such as Linear’s, which you can sign in to with OAuth instead of a key (see add an MCP server)

1. In the access bundle, select Add Service.

2. On the Choose a template panel, pick the template for the API, or select Custom HTTP API.

   
3. On the Details step, check the hosts the service covers, or enter the API’s host if you selected Custom HTTP API. Select Continue.

   
4. On the Credential step, paste the real key, then select Continue.

   If the API takes the key somewhere other than a header, such as a bot token in the URL, add a substitution instead. Your agent sends the placeholder you enter in Replace.

5. On the Review step, select Add Service. Repeat from the first step for each remaining key.

API

​

Log in as a machine identity

You call the Infisical API as a machine identity with the Admin role in your Agent Vault project.

1. In your Agent Vault project, go to Access Control > Machine Identities and select Add Machine Identity.

2. On the Create New tab, enter a Name, choose Admin in Role, then select Create.

3. On the machine identity’s page, select Universal Auth under Authentication. Copy the Client ID, then select Add Client Secret and copy the client secret.

Use this machine identity only for setup. If your agents’ sessions come from code, the guide for your agents has you create a separate machine identity with access to only one access bundle.

Call the login endpoint for Universal Auth with the client ID and client secret:

US Cloud

curl -X POST https://app.infisical.com/api/v1/auth/universal-auth/login \
  -H "Content-Type: application/json" \
  -d '{"clientId": "<client-id>", "clientSecret": "<client-secret>"}'

The response includes an accessToken, which you send with each request in the next steps.

​

Copy the project ID

Requests that create something in Agent Vault take the ID of the project to create it in. In your Agent Vault project, go to Administration > Settings and copy the Project ID.

​

Create an access bundle

In Agent Vault, an access bundle defines the services your agents can reach. Call the endpoint to create an access bundle, replacing <access-token> with the accessToken from the login response and <project-id> with the project ID. In the body, send the project ID and a name for the access bundle:

US Cloud

curl -X POST https://app.infisical.com/api/v1/agent-vault/access-bundles \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{"projectId": "<project-id>", "name": "code-review"}'

The response includes the access bundle’s id, which you need to add a service.

​

Add a service

Add a service for each key your agent uses.

What services do I need?

• Its model provider’s API key, such as ANTHROPIC_API_KEY, if the agent uses one
• Each API it calls, such as GitHub
• For a messaging gateway, the platform’s token (see the keys that Hermes or OpenClaw uses)
• Each remote MCP server it connects to, such as Linear’s (see add an MCP server)

Call the endpoint to create a service, replacing <access-bundle-id> in the URL with the id from the previous step and <access-token> with the accessToken from the login response.

In the body, send the hosts that the credential applies to and the credential itself. For example, to add a GitHub personal access token:

US Cloud

curl -X POST https://app.infisical.com/api/v1/agent-vault/access-bundles/<access-bundle-id>/services \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "http",
    "name": "github",
    "hostPattern": "api.github.com, github.com",
    "credential": {
      "type": "basic",
      "username": "x-access-token",
      "password": "<github-token>"
    }
  }'

Set credential.type to bearer for an API that takes a token in a header, basic for an API that takes a username and password, or passthrough for a host that the agent can call without a credential.

For a key that goes somewhere other than a header, set credential to {"type": "passthrough"} and send the key as a substitution:

"credential": { "type": "passthrough" },
"substitutions": [
  { "placeholder": "__TELEGRAM_BOT_TOKEN__", "surfaces": ["path"], "value": "<telegram-bot-token>" }
]

Repeat this request for each remaining key.

​

Step 3: Connect your agents

Pick the guide for where your agents run. Each guide continues from the access bundle you just created.

If you’re not sure which guide fits, plan your setup to get a recommendation.

Modal

Run an Agent Vault proxy in each Modal sandbox so the agent never has access to a credential.

Daytona

Run an Agent Vault proxy beside each Daytona sandbox so the agent never has access to a credential.

Kubernetes

Learn how to run AI agents in Kubernetes pods that contain no credentials and can only connect to the Agent Vault proxy.

Docker

Run an Agent Vault proxy beside each agent container so the agent never has access to a credential.

E2B sandboxes

Run an Agent Vault proxy for your E2B sandboxes so the agent never has access to a credential.

Cursor Cloud Agents

Run an Agent Vault proxy beside your Cursor workers on Kubernetes so the agent never has access to a credential.