> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Add your credentials to Agent Vault > Store your credentials in an access bundle and connect the agents that use them. This quickstart walks you through the setup shared by every Agent Vault workflow. You'll create an [Agent Vault project](https://infisical.com/docs/documentation/platform/agent-vault/projects.md), create an [access bundle](https://infisical.com/docs/documentation/platform/agent-vault/access-bundles.md), add a [service](https://infisical.com/docs/documentation/platform/agent-vault/services) for each key your agent uses, and then continue with the guide for where your agent runs. ## Prerequisites * An Infisical organization where you can create projects (organization admins and members can by default) * The API keys your agent uses, such as its model provider's key ## Step 1: Create an Agent Vault project An Agent Vault project holds the credentials, members, and proxies for one agentic system or team. If you already have a project for this agent, such as **My first project**, open it and skip to [Step 2](#step-2-add-your-credentials). **Step 1** On your organization's overview in Infisical, select **Agent Vault**. **Step 2** Select **New Project**, enter a **Project Name**, then select **Create Project**. ![The Create a New Agent Vault Project dialog, with a project name, a description, and a Create Project button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/project-create.png) You become the project's admin. ## Step 2: Add your credentials > [tab] Infisical dashboard > > ### Create an access bundle > > In Agent Vault, an [access bundle](https://infisical.com/docs/documentation/platform/agent-vault/access-bundles.md) defines the [services](https://infisical.com/docs/documentation/platform/agent-vault/services) your agents can reach. To create an access bundle: > > **Step 1** > > In your Agent Vault project, go to **Access Bundles**. > > **Step 2** > > Select **Create Access Bundle**. Give the access bundle a **Name**, such as `code-review`, then select **Create Access Bundle**. > > ![The Create Access Bundle dialog with a name and a description entered](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/access-bundle-create.png) > > ### Add a service > > Next, add a service for each key your agent uses. > > > [accordion] What services do I need? > > > > * Its model provider's API key, such as `ANTHROPIC_API_KEY`, if the agent uses one > > * Each API it calls, such as GitHub > > * For a messaging gateway, the platform's token (see the keys that [Hermes](https://infisical.com/docs/documentation/platform/agent-vault/guides/hermes-gateway#step-1-list-the-api-keys-hermes-uses) or [OpenClaw](https://infisical.com/docs/documentation/platform/agent-vault/guides/openclaw-gateway#step-1-list-the-api-keys-openclaw-uses) uses) > > * Each remote MCP server it connects to, such as Linear's, which you can sign in to with OAuth instead of a key (see [add an MCP server](https://infisical.com/docs/documentation/platform/agent-vault/mcp-servers.md#add-an-mcp-server)) > > **Step 1** > > In the access bundle, select **Add Service**. > > **Step 2** > > On the **Choose a template** panel, pick the template for the API, or select **Custom HTTP API**. > > ![The Choose a template panel with MCP server templates and HTTP API templates, GitHub among them](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/service-template-picker.png) > > **Step 3** > > On the **Details** step, check the hosts the service covers, or enter the API's host if you selected **Custom HTTP API**. Select **Continue**. > > ![The Details step of a GitHub service, with api.github.com as the host](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/service-details.png) > > **Step 4** > > On the **Credential** step, paste the real key, then select **Continue**. > > > [!NOTE] > > > > If the API takes the key somewhere other than a header, such as a bot token in the URL, [add a substitution](https://infisical.com/docs/documentation/platform/agent-vault/http-apis.md#add-a-substitution) instead. Your agent sends the placeholder you enter in **Replace**. > > **Step 5** > > On the **Review** step, select **Add Service**. Repeat from the first step for each remaining key. > [tab] API > > ### Log in as a machine identity > > You call the Infisical API as a [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md) with the **Admin** role in your Agent Vault project. > > **Step 1** > > In your Agent Vault project, go to **Access Control** > **Machine Identities** and select **Add Machine Identity**. > > **Step 2** > > On the **Create New** tab, enter a **Name**, choose **Admin** in **Role**, then select **Create**. > > **Step 3** > > On the machine identity's page, select **Universal Auth** under **Authentication**. Copy the **Client ID**, then select **Add Client Secret** and copy the client secret. > > Use this machine identity only for setup. If your agents' sessions come from code, the guide for your agents has you create a separate machine identity with access to only one access bundle. > > Call [the login endpoint for Universal Auth](https://infisical.com/docs/api-reference/endpoints/universal-auth/login.md) with the client ID and client secret: > > ```bash US Cloud theme={"dark"} > curl -X POST https://app.infisical.com/api/v1/auth/universal-auth/login \ > -H "Content-Type: application/json" \ > -d '{"clientId": "", "clientSecret": ""}' > ``` > > ```bash EU Cloud theme={"dark"} > curl -X POST https://eu.infisical.com/api/v1/auth/universal-auth/login \ > -H "Content-Type: application/json" \ > -d '{"clientId": "", "clientSecret": ""}' > ``` > > ```bash Self-hosted theme={"dark"} > curl -X POST /api/v1/auth/universal-auth/login \ > -H "Content-Type: application/json" \ > -d '{"clientId": "", "clientSecret": ""}' > ``` > > The response includes an `accessToken`, which you send with each request in the next steps. > > ### Copy the project ID > > Requests that create something in Agent Vault take the ID of the project to create it in. In your Agent Vault project, go to **Administration** > **Settings** and copy the **Project ID**. > > ![The General settings of an Agent Vault project, with the Project ID and its copy button in the Project Overview card](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/project-settings-general.png) > > ### Create an access bundle > > In Agent Vault, an [access bundle](https://infisical.com/docs/documentation/platform/agent-vault/access-bundles.md) defines the [services](https://infisical.com/docs/documentation/platform/agent-vault/services) your agents can reach. Call [the endpoint to create an access bundle](https://infisical.com/docs/api-reference/endpoints/agent-vault-access-bundles/create.md), replacing `` with the `accessToken` from the login response and `` with the project ID. In the body, send the project ID and a name for the access bundle: > > ```bash US Cloud theme={"dark"} > curl -X POST https://app.infisical.com/api/v1/agent-vault/access-bundles \ > -H "Authorization: Bearer " \ > -H "Content-Type: application/json" \ > -d '{"projectId": "", "name": "code-review"}' > ``` > > ```bash EU Cloud theme={"dark"} > curl -X POST https://eu.infisical.com/api/v1/agent-vault/access-bundles \ > -H "Authorization: Bearer " \ > -H "Content-Type: application/json" \ > -d '{"projectId": "", "name": "code-review"}' > ``` > > ```bash Self-hosted theme={"dark"} > curl -X POST /api/v1/agent-vault/access-bundles \ > -H "Authorization: Bearer " \ > -H "Content-Type: application/json" \ > -d '{"projectId": "", "name": "code-review"}' > ``` > > The response includes the access bundle's `id`, which you need to add a service. > > ### Add a service > > Add a service for each key your agent uses. > > > [accordion] What services do I need? > > > > * Its model provider's API key, such as `ANTHROPIC_API_KEY`, if the agent uses one > > * Each API it calls, such as GitHub > > * For a messaging gateway, the platform's token (see the keys that [Hermes](https://infisical.com/docs/documentation/platform/agent-vault/guides/hermes-gateway#step-1-list-the-api-keys-hermes-uses) or [OpenClaw](https://infisical.com/docs/documentation/platform/agent-vault/guides/openclaw-gateway#step-1-list-the-api-keys-openclaw-uses) uses) > > * Each remote MCP server it connects to, such as Linear's (see [add an MCP server](https://infisical.com/docs/documentation/platform/agent-vault/mcp-servers.md#add-an-mcp-server)) > > Call [the endpoint to create a service](https://infisical.com/docs/api-reference/endpoints/agent-vault-services/create.md), replacing `` in the URL with the `id` from the previous step and `` with the `accessToken` from the login response. > > In the body, send the hosts that the credential applies to and the credential itself. For example, to add a GitHub personal access token: > > ```bash US Cloud theme={"dark"} > curl -X POST https://app.infisical.com/api/v1/agent-vault/access-bundles//services \ > -H "Authorization: Bearer " \ > -H "Content-Type: application/json" \ > -d '{ > "type": "http", > "name": "github", > "hostPattern": "api.github.com, github.com", > "credential": { > "type": "basic", > "username": "x-access-token", > "password": "" > } > }' > ``` > > ```bash EU Cloud theme={"dark"} > curl -X POST https://eu.infisical.com/api/v1/agent-vault/access-bundles//services \ > -H "Authorization: Bearer " \ > -H "Content-Type: application/json" \ > -d '{ > "type": "http", > "name": "github", > "hostPattern": "api.github.com, github.com", > "credential": { > "type": "basic", > "username": "x-access-token", > "password": "" > } > }' > ``` > > ```bash Self-hosted theme={"dark"} > curl -X POST /api/v1/agent-vault/access-bundles//services \ > -H "Authorization: Bearer " \ > -H "Content-Type: application/json" \ > -d '{ > "type": "http", > "name": "github", > "hostPattern": "api.github.com, github.com", > "credential": { > "type": "basic", > "username": "x-access-token", > "password": "" > } > }' > ``` > > Set `credential.type` to `bearer` for an API that takes a token in a header, `basic` for an API that takes a username and password, or `passthrough` for a host that the agent can call without a credential. > > > [!NOTE] > > > > For a key that goes somewhere other than a header, set `credential` to `{"type": "passthrough"}` and send the key as a [substitution](https://infisical.com/docs/documentation/platform/agent-vault/http-apis.md#substitutions): > > > > ```json theme={"dark"} > > "credential": { "type": "passthrough" }, > > "substitutions": [ > > { "placeholder": "__TELEGRAM_BOT_TOKEN__", "surfaces": ["path"], "value": "" } > > ] > > ``` > > Repeat this request for each remaining key. ## Step 3: Connect your agents Pick the guide for where your agents run. Each guide continues from the access bundle you just created. > [!TIP] > > If you're not sure which guide fits, [plan your setup](https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup.md) to get a recommendation. > [card] [Modal](https://infisical.com/docs/documentation/platform/agent-vault/guides/modal.md) > > Run an Agent Vault proxy in each Modal sandbox so the agent never has access to a credential. > [card] [Daytona](https://infisical.com/docs/documentation/platform/agent-vault/guides/daytona.md) > > Run an Agent Vault proxy beside each Daytona sandbox so the agent never has access to a credential. > [card] [Kubernetes](https://infisical.com/docs/documentation/platform/agent-vault/guides/kubernetes) > > Learn how to run AI agents in Kubernetes pods that contain no credentials and can only connect to the Agent Vault proxy. > [card] [Docker](https://infisical.com/docs/documentation/platform/agent-vault/guides/docker.md) > > Run an Agent Vault proxy beside each agent container so the agent never has access to a credential. > [card] [E2B sandboxes](https://infisical.com/docs/documentation/platform/agent-vault/guides/e2b.md) > > Run an Agent Vault proxy for your E2B sandboxes so the agent never has access to a credential. > [card] [Cursor Cloud Agents](https://infisical.com/docs/documentation/platform/agent-vault/guides/cursor.md) > > Run an Agent Vault proxy beside your Cursor workers on Kubernetes so the agent never has access to a credential. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.