> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Agent Vault with OpenClaw > Launch OpenClaw with Agent Vault so it can make authenticated API calls without needing an actual token. I want to access This quickstart guide walks you through using Agent Vault to launch an agent that makes authenticated API calls without needing an actual token. > [!TIP] > > This guide runs Hermes in your terminal. If you chat with Hermes through Slack, Telegram, or another messaging platform, follow [Agent Vault with the Hermes gateway](https://infisical.com/docs/documentation/platform/agent-vault/guides/hermes-gateway.md) instead. > [!TIP] > > This guide runs OpenClaw in your terminal. If you chat with OpenClaw through Slack, Telegram, or another messaging platform, follow [Agent Vault with the OpenClaw gateway](https://infisical.com/docs/documentation/platform/agent-vault/guides/openclaw-gateway.md) instead. ## Prerequisites > [!NOTE] > > We recommend running the proxy on a different machine than the agent. If they run on the same machine, the agent could read the proxy token and the private key of the proxy's certificate authority. > > We also recommend keeping both machines on the same private network. This is because every request the agent makes goes through the proxy, and a round trip between networks adds latency to every request. ## Step 1: Set up in Infisical ### Create an access bundle First, create an [access bundle](https://infisical.com/docs/documentation/platform/agent-vault/access-bundles.md) that defines which APIs ([services](https://infisical.com/docs/documentation/platform/agent-vault/services.md)) the agent can access. **Step 1** In Infisical, open **Agent Vault** from the product switcher and go to **Access Bundles**. **Step 2** Select **Create Access Bundle**. Give the access bundle a **Name**, then select **Create Access Bundle**. ![The Create Access Bundle dialog with code-review entered as the name](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/access-bundle-create.png) **Step 3** Select the access bundle you just created, then select **Add Service**. Find the template for the API you want the agent to access, then select it. Select the **GitHub** template. Select the **Slack** template. Select the **Anthropic** template. Select the **OpenAI** template. Select **Custom**. You'll set the host, header name, and prefix yourself on the next step. Select the **Google Gemini** template. Select the **Mistral AI** template. Select the **Cohere** template. Select the **Groq** template. Select the **Perplexity** template. Select the **OpenRouter** template. Select the **Together AI** template. Select the **DeepSeek** template. Select the **xAI** template. Select the **Fireworks AI** template. Select the **Stripe** template. Select the **Twilio** template. Select the **SendGrid** template. Select the **Resend** template. Select the **Discord** template. Select the **Postmark** template. Select the **GitLab** template. Select the **Vercel** template. Select the **Cloudflare** template. Select the **Supabase** template. Select the **npm** template. Select the **GitHub Packages** template. Select the **Datadog** template. Select the **Sentry** template. Select the **PagerDuty** template. Select the **Linear** template. Select the **Notion** template. Select the **Jira** template. Select the **Google Workspace** template. Select the **Shopify** template. ![The Choose a template panel with GitHub among the available services](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/service-template-picker.png) > [!NOTE] > > If the API you want to access isn't on the template list, pick **Custom** and set the host, header name, and prefix yourself. For more information, check out the [services](https://infisical.com/docs/documentation/platform/agent-vault/services.md) documentation. **Step 4** The template fills in the host and header. Paste a [GitHub personal access token](https://github.com/settings/tokens) in the **Credential** section. The template fills in the host and header. Paste a [Slack bot token](https://api.slack.com/authentication/token-types#bot) in the **Credential** section. The template fills in the host and header. Paste an [Anthropic API key](https://console.anthropic.com/settings/keys) in the **Credential** section. The template fills in the host and header. Paste an [OpenAI API key](https://platform.openai.com/api-keys) in the **Credential** section. Fill in the **Host**, **Header name**, and any **Prefix** the API expects. Then paste your credential in the **Credential** section. Follow the steps to set up the service. The template automatically fills in most fields, including: * The host (for example, `api.github.com`) * The header the API expects (for example, `Authorization: Bearer `) Paste your credentials in the **Credential** section. The template fills in the host and header. Paste a [Google Gemini API key](https://aistudio.google.com/apikey) in the **Credential** section. The template fills in the host and header. Paste a [Mistral AI API key](https://console.mistral.ai/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Cohere API key](https://dashboard.cohere.com/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Groq API key](https://console.groq.com/keys) in the **Credential** section. The template fills in the host and header. Paste a [Perplexity API key](https://www.perplexity.ai/settings/api) in the **Credential** section. The template fills in the host and header. Paste an [OpenRouter API key](https://openrouter.ai/keys) in the **Credential** section. The template fills in the host and header. Paste a [Together AI API key](https://api.together.xyz/settings/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [DeepSeek API key](https://platform.deepseek.com/api_keys) in the **Credential** section. The template fills in the host and header. Paste an [xAI API key](https://console.x.ai/) in the **Credential** section. The template fills in the host and header. Paste a [Fireworks AI API key](https://app.fireworks.ai/settings/users/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Stripe secret key](https://dashboard.stripe.com/apikeys) in the **Credential** section. The template fills in the host and header. Paste a [Twilio account SID and auth token](https://console.twilio.com/) in the **Credential** section. The template fills in the host and header. Paste a [SendGrid API key](https://app.sendgrid.com/settings/api_keys) in the **Credential** section. The template fills in the host and header. Paste a [Resend API key](https://resend.com/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Discord bot token](https://discord.com/developers/applications) in the **Credential** section. The template fills in the host and header. Paste a [Postmark server token](https://account.postmarkapp.com/servers) in the **Credential** section. The template fills in the host and header. Paste a [GitLab personal access token](https://gitlab.com/-/user_settings/personal_access_tokens) in the **Credential** section. The template fills in the host and header. Paste a [Vercel API token](https://vercel.com/account/tokens) in the **Credential** section. The template fills in the host and header. Paste a [Cloudflare API token](https://dash.cloudflare.com/profile/api-tokens) in the **Credential** section. The template fills in the header and a `.supabase.co` host. Replace `` with your Supabase project ref, then paste your project's [`anon` or `service_role` API key](https://supabase.com/dashboard) (under **Project Settings** > **API Keys**) in the **Credential** section. The template fills in the host and header. Paste an [npm access token](https://docs.npmjs.com/creating-and-viewing-access-tokens) in the **Credential** section. The template fills in the host and header. Paste a [GitHub personal access token with the `read:packages` scope](https://github.com/settings/tokens) in the **Credential** section. The template fills in the host and header. Paste a [Datadog API key](https://app.datadoghq.com/organization-settings/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Sentry auth token](https://sentry.io/settings/account/api/auth-tokens/) in the **Credential** section. The template fills in the host and header. Paste a [PagerDuty API access key](https://support.pagerduty.com/main/docs/api-access-keys) in the **Credential** section. The template fills in the host and header. Paste a [Linear API key](https://linear.app/settings/api) in the **Credential** section. The template fills in the host and header. Paste a [Notion integration token](https://www.notion.so/profile/integrations) in the **Credential** section. The template fills in the header and a `.atlassian.net` host. Replace `` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`), then paste your [Jira email and API token](https://id.atlassian.com/manage-profile/security/api-tokens) in the **Credential** section. The template fills in the host and header. Paste a [Google Workspace OAuth token](https://developers.google.com/workspace/guides/create-credentials) in the **Credential** section. The template fills in the header and a `.myshopify.com` host. Replace `` with your Shopify store subdomain, then paste your [Shopify Admin API access token](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens) in the **Credential** section. **Step 5** Once you've configured the service, select **Add Service**. > [!TIP] > > You can repeat these steps to add as many more services as you like to the access bundle. ### Create a proxy Next, create a [proxy](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md) to intercept API calls from your agent. **Step 1** Go to **Proxies** and select **Create Proxy**. **Step 2** Give the proxy a **Name**, then select **Create**. The **Proxy Token** dialog shows the proxy token once, with a command to start the proxy. Copy the command from the **CLI** tab for the next step. **Step 3** On the host that will act as the proxy, run the command from the previous step. ```bash theme={"dark"} INFISICAL_AGENT_VAULT_PROXY_TOKEN= \ infisical agent-vault proxy \ --domain ``` The proxy starts listening on port `17323`. Leave it running and note this host's address. You'll need the address when you launch your agent. > [!NOTE] > > This runs the proxy in your current terminal, so the proxy stops when the terminal closes. For a persistent setup, use the **Docker** command or the **Kubernetes** manifest from the **Proxy Token** dialog, or [run the proxy with systemd](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md#create-a-proxy-and-start-it). > > Check out the [proxies documentation](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md) for more information. ### Create a session Next, create a [session](https://infisical.com/docs/documentation/platform/agent-vault/sessions) with your access bundle attached. **Step 1** Go to **Sessions** and select **Create Session**. **Step 2** Pick the **Access Bundle** the agent should use, set a duration under **Expires**, then select **Create Session**. ![The Create Session dialog with code-review picked and a seven day expiry](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/session-create.png) **Step 3** This creates the session and gives you a command to run your agent with it. Copy the command for the next step. ![The Session Created dialog showing the infisical agent-vault run command with the session token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/session-created.png) ## Step 2: Launch your agent On the host where the agent runs, paste the command you copied in the previous step. Replace `` with your host's actual domain or IP address, and `` with your agent's own command. For example, with Claude: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- claude ``` For Claude Code, the command is `claude`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- claude ``` For Codex, the command is `codex`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- codex ``` > [!NOTE] > > Codex first tries to reach the OpenAI API over a WebSocket, which [fails through the proxy](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md#supported-connections). You may see a few connection errors before Codex switches to HTTPS and responds. Hermes reads its API keys from `~/.hermes/.env`, and it won't start without them. If the service you added holds one of those keys, such as your model provider's key, replace the key's value in that file with a placeholder, such as `agent-vault-openai`. The proxy attaches the real key, so Hermes only needs a value it accepts. If the service uses a [substitution](https://infisical.com/docs/documentation/platform/agent-vault/services.md#substitutions), use the exact value you entered in **Replace** instead. > [!WARNING] > > Hermes treats some values as an unset key, including `dummy`, `placeholder`, `changeme`, `none`, and values made only of `x` characters, such as `sk-xxxx`. If you use one of these values, Hermes reports the key as missing instead of sending it to the proxy. Then start Hermes. For Hermes Agent, the command is `hermes --tui`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- hermes --tui ``` For OpenCode, the command is `opencode`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- opencode ``` If the service you added holds your model provider's key, OpenClaw needs a placeholder in its place. Onboarding saves the key in OpenClaw's credential store. Run `openclaw models auth list` to find the saved profile, then remove it with `openclaw models auth logout `. Then create `~/.openclaw/.env`, or add to it if it already exists, with a placeholder for the key, such as `OPENAI_API_KEY=agent-vault-openai`. The proxy attaches the real key, so OpenClaw only needs a value to send. If the service uses a [substitution](https://infisical.com/docs/documentation/platform/agent-vault/services.md#substitutions), use the exact value you entered in **Replace** instead. Then start OpenClaw's terminal UI in local mode, so it runs without a separate Gateway. For OpenClaw, the command is `openclaw tui --local`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- openclaw tui --local ``` > [!TIP] > > Instead of passing `--session-token` and `--proxy`, you can set the [`INFISICAL_AGENT_VAULT_SESSION_TOKEN` and `INFISICAL_AGENT_VAULT_PROXY_ADDRESS` environment variables](https://infisical.com/docs/cli/reference#agent-vault-run). The CLI adds the proxy's certificate authority to the agent process' trusted CAs and starts the agent with its HTTP traffic routed through the proxy. Any calls to services in your access bundle leave the proxy with the real credential attached, while calls to any other host go out normally. > [!NOTE] > > On macOS, you'll need to enter your user password when running your agent for the first time. This is because macOS needs your approval to add the proxy's certificate to your keychain. ## Step 3: Verify it works To confirm the proxy is attaching credentials, make a test call to a service you configured. Pick an authenticated endpoint on that service (for example, one that returns your account), and make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Anthropic. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Cloudflare. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Cohere. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Datadog. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to DeepSeek. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Discord. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Fireworks AI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to GitHub. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to GitHub Packages. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to GitLab. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Google Gemini. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Google Workspace. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Groq. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Jira. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Linear. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Mistral AI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Notion. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to npm. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to OpenAI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to OpenRouter. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to PagerDuty. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Perplexity. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Postmark. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Resend. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to SendGrid. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Sentry. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Shopify. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Slack. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Stripe. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Supabase. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Together AI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Twilio. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Vercel. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to xAI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to the API you configured. Make the call one of two ways: **With your agent** In your running agent's session, ask it to make the call. For example: > Run `curl -sS ` and show me the output. The API should respond successfully. The agent doesn't need any real API credentials because the proxy attaches the credential as the request passes through. Run the same command outside the agent, and it fails with an authentication error. > Run `curl -sS https://api.github.com/user` and show me the output. GitHub returns your account. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://slack.com/api/auth.test` and show me the output. Slack returns your workspace and user IDs. Run the same request outside the agent and it returns `not_authed`. > Run `curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01"` and show me the output. Anthropic returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.openai.com/v1/models` and show me the output. OpenAI returns the list of available models. Run the same request outside the agent and it fails with a 401. Ask the agent to hit an authenticated endpoint. The proxy attaches the credential as the request passes through, so the agent needs no real token. Run the same request outside the agent and it should fail with an authentication error. > Run `curl -sS https://generativelanguage.googleapis.com/v1beta/models` and show me the output. Google Gemini returns the list of available models. Run the same request outside the agent and it fails with a 403. > Run `curl -sS https://api.mistral.ai/v1/models` and show me the output. Mistral AI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.cohere.com/v1/models` and show me the output. Cohere returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.groq.com/openai/v1/models` and show me the output. Groq returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.deepseek.com/v1/models` and show me the output. DeepSeek returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://openrouter.ai/api/v1/credits` and show me the output. OpenRouter returns your credit balance. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.together.xyz/v1/models` and show me the output. Together AI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.x.ai/v1/models` and show me the output. xAI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.fireworks.ai/inference/v1/models` and show me the output. Fireworks AI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.perplexity.ai/async/chat/completions` and show me the output. Perplexity returns the list of your async requests. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify` and show me the output. Cloudflare returns your token's status. Run the same request outside the agent and it fails with a 400. > Run `curl -sS https://api.datadoghq.com/api/v1/validate` and show me the output. Datadog confirms your API key is valid. Run the same request outside the agent and it fails with a 403. > Run `curl -sS https://discord.com/api/v10/users/@me` and show me the output. Discord returns your bot user. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://gitlab.com/api/v4/user` and show me the output. GitLab returns your user profile. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://npm.pkg.github.com/-/whoami` and show me the output. GitHub Packages returns your npm username, confirming the token is valid. Run the same request outside the agent and it fails with a 403. > Run `curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28"` and show me the output. Notion returns your bot user. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://registry.npmjs.org/-/whoami` and show me the output. npm returns your username. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.pagerduty.com/users/me` and show me the output. PagerDuty returns your user profile. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.postmarkapp.com/server` and show me the output. Postmark returns your server's info. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.resend.com/api-keys` and show me the output. Resend returns your API keys. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.sendgrid.com/v3/user/account` and show me the output. SendGrid returns your account info. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://sentry.io/api/0/organizations/` and show me the output. Sentry returns the organizations your token can access. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.stripe.com/v1/account` and show me the output. Stripe returns your account. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.vercel.com/v2/user` and show me the output. Vercel returns your user profile. Run the same request outside the agent and it fails with a 403. Ask the agent to make a call to a Google Workspace API. For example: ```bash Gmail theme={"dark"} curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile ``` ```bash Google Calendar theme={"dark"} curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList ``` ```bash Google Drive theme={"dark"} curl -sS https://www.googleapis.com/drive/v3/about?fields=user ``` Google returns your Gmail profile, calendars, or Drive info depending on the endpoint. Run the same request outside the agent and it fails with a 401. > [!NOTE] > > Replace `` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`). > Run `curl -sS https://.atlassian.net/rest/api/3/myself` and show me the output. Jira returns your user profile. Run the same request outside the agent and it fails with a 401. > [!NOTE] > > Replace `` with your Twilio Account SID from the [Twilio console](https://console.twilio.com/). > Run `curl -sS https://api.twilio.com/2010-04-01/Accounts/.json` and show me the output. Twilio returns your account. Run the same request outside the agent and it fails with a 401. > [!NOTE] > > Replace `` with your Shopify store subdomain (for example, `mystore` from `mystore.myshopify.com`). > Run `curl -sS https://.myshopify.com/admin/api/2024-01/shop.json` and show me the output. Shopify returns your shop info. Run the same request outside the agent and it fails with a 401. > [!NOTE] > > Replace `` with your Supabase project ref from the [project settings](https://supabase.com/dashboard). > Run `curl -sS https://.supabase.co/rest/v1/` and show me the output. Supabase returns the OpenAPI schema for your project. Run the same request outside the agent and it fails with a 401. > Run `curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}'` and show me the output. Linear returns your user info. Run the same request outside the agent and it fails with a 401. **With `curl`** Any HTTP client works the same way. Run it through the proxy in place of your agent's command: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.github.com/user ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://slack.com/api/auth.test ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01" ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.openai.com/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://generativelanguage.googleapis.com/v1beta/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.mistral.ai/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.cohere.com/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.groq.com/openai/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.deepseek.com/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://openrouter.ai/api/v1/credits ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.together.xyz/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.x.ai/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.fireworks.ai/inference/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.perplexity.ai/async/chat/completions ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.datadoghq.com/api/v1/validate ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://discord.com/api/v10/users/@me ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://gitlab.com/api/v4/user ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://npm.pkg.github.com/-/whoami ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28" ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://registry.npmjs.org/-/whoami ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.pagerduty.com/users/me ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.postmarkapp.com/server ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.resend.com/api-keys ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.sendgrid.com/v3/user/account ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://sentry.io/api/0/organizations/ ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.stripe.com/v1/account ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.vercel.com/v2/user ``` ```bash Gmail theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile ``` ```bash Google Calendar theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList ``` ```bash Google Drive theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://www.googleapis.com/drive/v3/about?fields=user ``` > [!NOTE] > > Replace `` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`). ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://.atlassian.net/rest/api/3/myself ``` > [!NOTE] > > Replace `` with your Twilio Account SID. ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.twilio.com/2010-04-01/Accounts/.json ``` > [!NOTE] > > Replace `` with your Shopify store subdomain. ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://.myshopify.com/admin/api/2024-01/shop.json ``` > [!NOTE] > > Replace `` with your Supabase project ref. ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://.supabase.co/rest/v1/ ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}' ``` The proxy logs the request as `brokered`. > [!TIP] > > Your agent now has a session where it can make authenticated calls to an API without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call GitHub without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Slack without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call the Anthropic API without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call the OpenAI API without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Google Gemini without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Mistral AI without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Cohere without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Groq without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Perplexity without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call OpenRouter without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Together AI without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call DeepSeek without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call xAI without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Fireworks AI without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Stripe without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Twilio without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call SendGrid without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Resend without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Discord without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Postmark without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call GitLab without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Vercel without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Cloudflare without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Supabase without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call npm without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call GitHub Packages without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Datadog without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Sentry without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call PagerDuty without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Linear without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Notion without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Jira without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Google Workspace without ever seeing a real token. > [!TIP] > > Your agent now has a session where it can call Shopify without ever seeing a real token. ## Troubleshooting > **Authentication error from the upstream API** > > The credential wasn't applied. Open your access bundle and confirm a service covers the host you called. If one does, the stored token is likely wrong. > **407 from the proxy** > > The session token was missing from the request. Confirm you passed `--session-token`, or that the token appears as the userinfo in your `HTTPS_PROXY` URL (like `http://x-agent-vault:@`). > **403 from the proxy** > > This could be for a few reasons: > > * The session was revoked or has expired (check the **Sessions** page in Infisical, and create a new one if needed) > * Under the proxy's [strict traffic policy](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md#traffic-policy), no service in the bundle covers the host you called (add a service that does, or use a pass-through service) > * The service covers the host, but doesn't allow the request's method or path (check the service's [methods and paths](https://infisical.com/docs/documentation/platform/agent-vault/services.md#methods-and-paths)) ## Next steps > **[Create sessions with the CLI](https://infisical.com/docs/documentation/platform/agent-vault/sessions-cli.md)** > > Run your agent from cron, a container, or CI, with a new session for each run. > **[Create sessions with the API](https://infisical.com/docs/documentation/platform/agent-vault/sessions-api.md)** > > Create sessions from code every time you start your agent. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.