> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart: Agent Vault

> Launch an agent that makes authenticated API calls without needing an actual token.

export const AgentVaultBranch = ({service, agent, serviceNot, agentNot, children}) => {
  const SELECTION_EVENT = "av-quickstart-selection-change";
  const KNOWN_SERVICE_IDS = new Set(["anthropic", "cloudflare", "cohere", "custom", "datadog", "deepseek", "discord", "fireworks", "gemini", "github", "github-npm", "gitlab", "google-workspace", "groq", "jira", "linear", "mistral", "notion", "npm", "openai", "openrouter", "pagerduty", "perplexity", "postmark", "resend", "sendgrid", "sentry", "shopify", "slack", "stripe", "supabase", "together", "twilio", "vercel", "xai"]);
  const KNOWN_AGENT_IDS = new Set(["claude-code", "codex", "opencode"]);
  const [selection, setSelection] = useState({
    service: null,
    agent: null
  });
  useEffect(() => {
    const sync = () => {
      const params = new URLSearchParams(window.location.search);
      setSelection({
        service: (() => {
          const v = params.get("service");
          return v && KNOWN_SERVICE_IDS.has(v) ? v : null;
        })(),
        agent: (() => {
          const v = params.get("agent");
          return v && KNOWN_AGENT_IDS.has(v) ? v : null;
        })()
      });
    };
    sync();
    window.addEventListener(SELECTION_EVENT, sync);
    window.addEventListener("popstate", sync);
    return () => {
      window.removeEventListener(SELECTION_EVENT, sync);
      window.removeEventListener("popstate", sync);
    };
  }, []);
  const parseList = raw => raw ? String(raw).split(",").map(entry => entry.trim()).filter(Boolean) : [];
  const matchesService = useMemo(() => {
    const current = selection.service ?? "none";
    if (service !== undefined && service !== null) {
      const wanted = parseList(service);
      if (wanted.length === 0) return true;
      if (!wanted.includes(current)) return false;
    }
    const excluded = parseList(serviceNot);
    if (excluded.includes(current)) return false;
    return true;
  }, [selection.service, service, serviceNot]);
  const matchesAgent = useMemo(() => {
    const current = selection.agent ?? "none";
    if (agent !== undefined && agent !== null) {
      const wanted = parseList(agent);
      if (wanted.length === 0) return true;
      if (!wanted.includes(current)) return false;
    }
    const excluded = parseList(agentNot);
    if (excluded.includes(current)) return false;
    return true;
  }, [selection.agent, agent, agentNot]);
  if (!matchesService || !matchesAgent) return null;
  return <>{children}</>;
};

export const AgentVaultQuickstartPicker = () => {
  const docsPath = typeof window === "undefined" ? "" : window.location.pathname;
  const docsBase = docsPath === "/docs" || docsPath.startsWith("/docs/") ? "/docs" : "";
  const SERVICE_IMG_BASE = "/images/agent-vault-templates";
  const AGENT_IMG_BASE = "/images/agent-vault-agents";
  const AGENT_IMAGES = {
    "claude-code": {
      dark: "claude-code.svg"
    },
    codex: {
      light: "OpenAI.png",
      dark: "OpenAIWhite.png"
    },
    opencode: {
      light: "opencode.svg",
      dark: "opencode.on-dark.svg"
    }
  };
  const SERVICE_IMAGES = {
    anthropic: {
      dark: "Anthropic.png"
    },
    cloudflare: {
      dark: "Cloudflare.png"
    },
    cohere: {
      dark: "Cohere.svg"
    },
    datadog: {
      light: "Datadog.png",
      dark: "DatadogWhite.png"
    },
    deepseek: {
      dark: "DeepSeek.svg"
    },
    discord: {
      dark: "Discord.svg"
    },
    fireworks: {
      dark: "Fireworks.png"
    },
    gemini: {
      dark: "Gemini.svg"
    },
    github: {
      light: "GitHub.on-light.png",
      dark: "GitHub.png"
    },
    "github-npm": {
      light: "GitHub.on-light.png",
      dark: "GitHub.png"
    },
    gitlab: {
      dark: "GitLab.png"
    },
    "google-workspace": {
      dark: "Google Workspace.svg"
    },
    groq: {
      dark: "Groq.svg"
    },
    jira: {
      dark: "Jira.svg"
    },
    linear: {
      dark: "Linear.svg"
    },
    mistral: {
      dark: "Mistral.svg"
    },
    notion: {
      dark: "Notion.svg"
    },
    npm: {
      dark: "NPM.svg"
    },
    openai: {
      light: "OpenAI.png",
      dark: "OpenAIWhite.png"
    },
    openrouter: {
      dark: "OpenRouter.png"
    },
    pagerduty: {
      dark: "PagerDuty.svg"
    },
    perplexity: {
      dark: "Perplexity.svg"
    },
    postmark: {
      dark: "Postmark.png"
    },
    resend: {
      light: "Resend.on-light.svg",
      dark: "Resend.svg"
    },
    sendgrid: {
      dark: "SendGrid.png"
    },
    sentry: {
      light: "Sentry.on-light.svg",
      dark: "Sentry.svg"
    },
    shopify: {
      dark: "Shopify.svg"
    },
    slack: {
      dark: "Slack.svg"
    },
    stripe: {
      dark: "Stripe.svg"
    },
    supabase: {
      dark: "Supabase.png"
    },
    together: {
      light: "Together.on-light.svg",
      dark: "Together.svg"
    },
    twilio: {
      dark: "Twilio.svg"
    },
    vercel: {
      dark: "Vercel.png"
    },
    xai: {
      light: "xAI.on-light.svg",
      dark: "xAI.svg"
    }
  };
  const buildSrc = (base, fileName) => `${docsBase}${base}/${fileName.split("/").map(encodeURIComponent).join("/")}`;
  const renderImageIcon = (image, base) => {
    if (!image) return null;
    const lightFile = image.light ?? image.dark;
    const darkFile = image.dark ?? image.light;
    if (lightFile === darkFile) {
      return <img src={buildSrc(base, lightFile)} alt="" className="ifx-avqs__img" />;
    }
    return <>
        <img src={buildSrc(base, lightFile)} alt="" className="ifx-avqs__img ifx-avqs__img--light-only" />
        <img src={buildSrc(base, darkFile)} alt="" className="ifx-avqs__img ifx-avqs__img--dark-only" />
      </>;
  };
  const renderAgentIcon = id => renderImageIcon(AGENT_IMAGES[id], AGENT_IMG_BASE);
  const renderServiceIcon = id => {
    if (id === "custom") {
      return <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
          <path d="M5 12h14" />
          <path d="M12 5v14" />
        </svg>;
    }
    return renderImageIcon(SERVICE_IMAGES[id], SERVICE_IMG_BASE);
  };
  const KNOWN_SERVICE_IDS = new Set(["anthropic", "cloudflare", "cohere", "custom", "datadog", "deepseek", "discord", "fireworks", "gemini", "github", "github-npm", "gitlab", "google-workspace", "groq", "jira", "linear", "mistral", "notion", "npm", "openai", "openrouter", "pagerduty", "perplexity", "postmark", "resend", "sendgrid", "sentry", "shopify", "slack", "stripe", "supabase", "together", "twilio", "vercel", "xai"]);
  const KNOWN_AGENT_IDS = new Set(["claude-code", "codex", "opencode"]);
  const SERVICES = [{
    id: "custom",
    label: "Custom API",
    chip: "a custom API"
  }, {
    id: "anthropic",
    label: "Anthropic",
    chip: "Anthropic"
  }, {
    id: "cloudflare",
    label: "Cloudflare",
    chip: "Cloudflare"
  }, {
    id: "cohere",
    label: "Cohere",
    chip: "Cohere"
  }, {
    id: "datadog",
    label: "Datadog",
    chip: "Datadog"
  }, {
    id: "deepseek",
    label: "DeepSeek",
    chip: "DeepSeek"
  }, {
    id: "discord",
    label: "Discord",
    chip: "Discord"
  }, {
    id: "fireworks",
    label: "Fireworks AI",
    chip: "Fireworks AI"
  }, {
    id: "github",
    label: "GitHub",
    chip: "GitHub"
  }, {
    id: "github-npm",
    label: "GitHub Packages",
    chip: "GitHub Packages"
  }, {
    id: "gitlab",
    label: "GitLab",
    chip: "GitLab"
  }, {
    id: "gemini",
    label: "Google Gemini",
    chip: "Google Gemini"
  }, {
    id: "google-workspace",
    label: "Google Workspace",
    chip: "Google Workspace"
  }, {
    id: "groq",
    label: "Groq",
    chip: "Groq"
  }, {
    id: "jira",
    label: "Jira",
    chip: "Jira"
  }, {
    id: "linear",
    label: "Linear",
    chip: "Linear"
  }, {
    id: "mistral",
    label: "Mistral AI",
    chip: "Mistral AI"
  }, {
    id: "notion",
    label: "Notion",
    chip: "Notion"
  }, {
    id: "npm",
    label: "npm",
    chip: "npm"
  }, {
    id: "openai",
    label: "OpenAI",
    chip: "OpenAI"
  }, {
    id: "openrouter",
    label: "OpenRouter",
    chip: "OpenRouter"
  }, {
    id: "pagerduty",
    label: "PagerDuty",
    chip: "PagerDuty"
  }, {
    id: "perplexity",
    label: "Perplexity",
    chip: "Perplexity"
  }, {
    id: "postmark",
    label: "Postmark",
    chip: "Postmark"
  }, {
    id: "resend",
    label: "Resend",
    chip: "Resend"
  }, {
    id: "sendgrid",
    label: "SendGrid",
    chip: "SendGrid"
  }, {
    id: "sentry",
    label: "Sentry",
    chip: "Sentry"
  }, {
    id: "shopify",
    label: "Shopify",
    chip: "Shopify"
  }, {
    id: "slack",
    label: "Slack",
    chip: "Slack"
  }, {
    id: "stripe",
    label: "Stripe",
    chip: "Stripe"
  }, {
    id: "supabase",
    label: "Supabase",
    chip: "Supabase"
  }, {
    id: "together",
    label: "Together AI",
    chip: "Together AI"
  }, {
    id: "twilio",
    label: "Twilio",
    chip: "Twilio"
  }, {
    id: "vercel",
    label: "Vercel",
    chip: "Vercel"
  }, {
    id: "xai",
    label: "xAI",
    chip: "xAI"
  }];
  const AGENTS = [{
    id: "claude-code",
    label: "Claude Code",
    chip: "Claude Code"
  }, {
    id: "codex",
    label: "Codex",
    chip: "Codex"
  }, {
    id: "opencode",
    label: "OpenCode",
    chip: "OpenCode"
  }];
  const SELECTION_EVENT = "av-quickstart-selection-change";
  const [selection, setSelection] = useState({
    service: null,
    agent: null
  });
  const [openMenu, setOpenMenu] = useState(null);
  const [searchService, setSearchService] = useState("");
  const [searchAgent, setSearchAgent] = useState("");
  const rootRef = useRef(null);
  const serviceButtonRef = useRef(null);
  const agentButtonRef = useRef(null);
  const searchInputRef = useRef(null);
  useEffect(() => {
    const sync = () => {
      const params = new URLSearchParams(window.location.search);
      setSelection({
        service: (() => {
          const v = params.get("service");
          return v && KNOWN_SERVICE_IDS.has(v) ? v : null;
        })(),
        agent: (() => {
          const v = params.get("agent");
          return v && KNOWN_AGENT_IDS.has(v) ? v : null;
        })()
      });
    };
    sync();
    window.addEventListener(SELECTION_EVENT, sync);
    window.addEventListener("popstate", sync);
    return () => {
      window.removeEventListener(SELECTION_EVENT, sync);
      window.removeEventListener("popstate", sync);
    };
  }, []);
  useEffect(() => {
    if (!openMenu) return undefined;
    const onDown = event => {
      if (rootRef.current && !rootRef.current.contains(event.target)) {
        setOpenMenu(null);
      }
    };
    const onKey = event => {
      if (event.key === "Escape") {
        setOpenMenu(null);
        const target = openMenu === "service" ? serviceButtonRef.current : agentButtonRef.current;
        if (target) target.focus();
      }
    };
    document.addEventListener("mousedown", onDown);
    document.addEventListener("keydown", onKey);
    return () => {
      document.removeEventListener("mousedown", onDown);
      document.removeEventListener("keydown", onKey);
    };
  }, [openMenu]);
  useEffect(() => {
    if (openMenu && searchInputRef.current) {
      searchInputRef.current.focus();
    }
  }, [openMenu]);
  const update = (dimension, value) => {
    const params = new URLSearchParams(window.location.search);
    if (value === null) params.delete(dimension); else params.set(dimension, value);
    const query = params.toString();
    const next = `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`;
    window.history.replaceState({}, "", next);
    window.dispatchEvent(new Event(SELECTION_EVENT));
    setOpenMenu(null);
    setSearchService("");
    setSearchAgent("");
  };
  const reset = () => {
    const params = new URLSearchParams(window.location.search);
    params.delete("service");
    params.delete("agent");
    const query = params.toString();
    const next = `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`;
    window.history.replaceState({}, "", next);
    window.dispatchEvent(new Event(SELECTION_EVENT));
    setOpenMenu(null);
  };
  const activeService = SERVICES.find(option => option.id === selection.service);
  const activeAgent = AGENTS.find(option => option.id === selection.agent);
  const hasSelection = Boolean(selection.service || selection.agent);
  const chevron = <svg className="ifx-avqs__chevron" width="10" height="10" viewBox="0 0 12 12" fill="none" aria-hidden="true">
      <path d="M3 4.5L6 7.5L9 4.5" stroke="currentColor" strokeWidth="1.75" strokeLinecap="round" strokeLinejoin="round" />
    </svg>;
  const renderMenu = (dimension, options, getIcon, activeId, searchValue, setSearch) => {
    const query = searchValue.trim().toLowerCase();
    const filtered = query ? options.filter(option => option.label.toLowerCase().includes(query)) : options;
    return <div className="ifx-avqs__menu" role="dialog" aria-label={`Choose ${dimension}`}>
        <div className="ifx-avqs__search">
          <svg className="ifx-avqs__search-icon" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
            <circle cx="11" cy="11" r="7" />
            <line x1="21" y1="21" x2="16.65" y2="16.65" />
          </svg>
          <input ref={searchInputRef} type="search" placeholder={`Search ${dimension === "service" ? "services" : "agents"}`} className="ifx-avqs__search-input" value={searchValue} onChange={event => setSearch(event.target.value)} />
        </div>
        {filtered.length > 0 ? <div className="ifx-avqs__grid" role="listbox" aria-label={`${dimension} options`}>
            {filtered.map(option => <button key={option.id} type="button" role="option" aria-selected={activeId === option.id} className={activeId === option.id ? "ifx-avqs__tile ifx-avqs__tile--active" : "ifx-avqs__tile"} onClick={() => update(dimension, option.id)}>
                {getIcon(option.id) && <span className="ifx-avqs__tile-icon">
                    {getIcon(option.id)}
                  </span>}
                <span className="ifx-avqs__tile-label">{option.label}</span>
              </button>)}
          </div> : <div className="ifx-avqs__empty">
            No matches for “{searchValue}”.
          </div>}
        {activeId && <button type="button" className="ifx-avqs__clear" onClick={() => update(dimension, null)}>
            Clear selection
          </button>}
      </div>;
  };
  return <div ref={rootRef} className="ifx-avqs">
      <p className="ifx-avqs__sentence">
        I want{" "}
        <span className="ifx-avqs__slot ifx-avqs__slot--agent">
          <button ref={agentButtonRef} type="button" aria-haspopup="dialog" aria-expanded={openMenu === "agent"} className={activeAgent ? "ifx-avqs__chip ifx-avqs__chip--filled" : "ifx-avqs__chip"} onClick={() => setOpenMenu(openMenu === "agent" ? null : "agent")}>
            {activeAgent && renderAgentIcon(activeAgent.id) && <span className="ifx-avqs__chip-icon">
                {renderAgentIcon(activeAgent.id)}
              </span>}
            <span>{activeAgent ? activeAgent.chip : "an agent"}</span>
            {chevron}
          </button>
          {openMenu === "agent" && renderMenu("agent", AGENTS, renderAgentIcon, selection.agent, searchAgent, setSearchAgent)}
        </span>{" "}
        to access{" "}
        <span className="ifx-avqs__slot ifx-avqs__slot--service">
          <button ref={serviceButtonRef} type="button" aria-haspopup="dialog" aria-expanded={openMenu === "service"} className={activeService ? "ifx-avqs__chip ifx-avqs__chip--filled" : "ifx-avqs__chip"} onClick={() => setOpenMenu(openMenu === "service" ? null : "service")}>
            {activeService && activeService.id !== "custom" && renderServiceIcon(activeService.id) && <span className="ifx-avqs__chip-icon">
                  {renderServiceIcon(activeService.id)}
                </span>}
            <span>{activeService ? activeService.chip : "a service"}</span>
            {chevron}
          </button>
          {openMenu === "service" && renderMenu("service", SERVICES, renderServiceIcon, selection.service, searchService, setSearchService)}
        </span>
      </p>
      <p className="ifx-avqs__hint">
        {hasSelection ? <>
            The steps below match your choice.{" "}
            <button type="button" className="ifx-avqs__reset" onClick={reset}>
              Reset
            </button>
          </> : "Pick to view tailored steps, or leave both to read the generic version of the guide."}
      </p>
    </div>;
};

<AgentVaultQuickstartPicker />

This quickstart guide walks you through using Agent Vault to launch an agent that makes authenticated API calls without needing an actual token.

## Prerequisites

<ul>
  <li>An Infisical organization where you're an Agent Vault admin</li>
  <li>The <a href="/docs/cli/overview">Infisical CLI</a> installed on the host that will run the proxy and on the host that will run the agent. For this guide, both hosts can be the same machine</li>

  <AgentVaultBranch agent="claude-code">
    <li><a href="https://docs.claude.com/en/docs/claude-code/overview">Claude Code</a> installed on the host that will run the agent</li>
  </AgentVaultBranch>

  <AgentVaultBranch agent="codex">
    <li><a href="https://github.com/openai/codex">Codex CLI</a> installed on the host that will run the agent</li>
  </AgentVaultBranch>

  <AgentVaultBranch agent="opencode">
    <li><a href="https://opencode.ai/">OpenCode</a> installed on the host that will run the agent</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="none">
    <li>Credentials for the API you want the agent to call (such as an API token)</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="github">
    <li>A <a href="https://github.com/settings/tokens">GitHub personal access token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="slack">
    <li>A <a href="https://api.slack.com/authentication/token-types#bot">Slack bot token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="anthropic">
    <li>An <a href="https://console.anthropic.com/settings/keys">Anthropic API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="openai">
    <li>An <a href="https://platform.openai.com/api-keys">OpenAI API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="custom">
    <li>A credential for the API you want the agent to call (such as an API token)</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="gemini">
    <li>A <a href="https://aistudio.google.com/apikey">Google Gemini API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="mistral">
    <li>A <a href="https://console.mistral.ai/api-keys">Mistral AI API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="cohere">
    <li>A <a href="https://dashboard.cohere.com/api-keys">Cohere API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="groq">
    <li>A <a href="https://console.groq.com/keys">Groq API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="perplexity">
    <li>A <a href="https://www.perplexity.ai/settings/api">Perplexity API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="openrouter">
    <li>An <a href="https://openrouter.ai/keys">OpenRouter API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="together">
    <li>A <a href="https://api.together.xyz/settings/api-keys">Together AI API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="deepseek">
    <li>A <a href="https://platform.deepseek.com/api_keys">DeepSeek API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="xai">
    <li>An <a href="https://console.x.ai/">xAI API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="fireworks">
    <li>A <a href="https://app.fireworks.ai/settings/users/api-keys">Fireworks AI API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="stripe">
    <li>A <a href="https://dashboard.stripe.com/apikeys">Stripe secret key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="twilio">
    <li>A <a href="https://console.twilio.com/">Twilio account SID and auth token</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="sendgrid">
    <li>A <a href="https://app.sendgrid.com/settings/api_keys">SendGrid API key</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="resend">
    <li>A <a href="https://resend.com/api-keys">Resend API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="discord">
    <li>A <a href="https://discord.com/developers/applications">Discord bot token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="postmark">
    <li>A <a href="https://account.postmarkapp.com/servers">Postmark server token</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="gitlab">
    <li>A <a href="https://gitlab.com/-/user_settings/personal_access_tokens">GitLab personal access token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="vercel">
    <li>A <a href="https://vercel.com/account/tokens">Vercel API token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="cloudflare">
    <li>A <a href="https://dash.cloudflare.com/profile/api-tokens">Cloudflare API token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="supabase">
    <li>A Supabase <a href="https://supabase.com/dashboard">project API key</a> (<code>anon</code> or <code>service\_role</code>, from <strong>Project Settings</strong> > <strong>API Keys</strong>)</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="npm">
    <li>An <a href="https://docs.npmjs.com/creating-and-viewing-access-tokens">npm access token</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="github-npm">
    <li>A <a href="https://github.com/settings/tokens">GitHub personal access token with the `read:packages` scope</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="datadog">
    <li>A <a href="https://app.datadoghq.com/organization-settings/api-keys">Datadog API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="sentry">
    <li>A <a href="https://sentry.io/settings/account/api/auth-tokens/">Sentry auth token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="pagerduty">
    <li>A <a href="https://support.pagerduty.com/main/docs/api-access-keys">PagerDuty API access key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="linear">
    <li>A <a href="https://linear.app/settings/api">Linear API key</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="notion">
    <li>A <a href="https://www.notion.so/profile/integrations">Notion integration token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="jira">
    <li>A <a href="https://id.atlassian.com/manage-profile/security/api-tokens">Jira email and API token</a></li>
  </AgentVaultBranch>

  <AgentVaultBranch service="google-workspace">
    <li>A <a href="https://developers.google.com/workspace/guides/create-credentials">Google Workspace OAuth token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>

  <AgentVaultBranch service="shopify">
    <li>A <a href="https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens">Shopify Admin API access token</a> with the scopes your agent will need</li>
  </AgentVaultBranch>
</ul>

## Step 1: Set up in Infisical

### Create an access bundle

First, create an [access bundle](/docs/documentation/platform/agent-vault/access-bundles) that defines which APIs ([services](/docs/documentation/platform/agent-vault/services)) the agent can access.

<Steps>
  <Step>
    In Infisical, open **Agent Vault** from the product switcher and go to **Access Bundles**.
  </Step>

  <Step>
    Select **Create Access Bundle**. Give the access bundle a **Name**, then select **Create Access Bundle**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/access-bundle-create.png" alt="The Create Access Bundle dialog with code-review entered as the name" />
    </Frame>
  </Step>

  <Step>
    Select the access bundle you just created, then select **Add Service**.

    <AgentVaultBranch service="none">
      Find the template for the API you want the agent to access, then select it.
    </AgentVaultBranch>

    <AgentVaultBranch service="github">
      Select the **GitHub** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="slack">
      Select the **Slack** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="anthropic">
      Select the **Anthropic** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="openai">
      Select the **OpenAI** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="custom">
      Select **Custom**. You'll set the host, header name, and prefix yourself on the next step.
    </AgentVaultBranch>

    <AgentVaultBranch service="gemini">
      Select the **Google Gemini** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="mistral">
      Select the **Mistral AI** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="cohere">
      Select the **Cohere** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="groq">
      Select the **Groq** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="perplexity">
      Select the **Perplexity** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="openrouter">
      Select the **OpenRouter** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="together">
      Select the **Together AI** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="deepseek">
      Select the **DeepSeek** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="xai">
      Select the **xAI** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="fireworks">
      Select the **Fireworks AI** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="stripe">
      Select the **Stripe** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="twilio">
      Select the **Twilio** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="sendgrid">
      Select the **SendGrid** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="resend">
      Select the **Resend** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="discord">
      Select the **Discord** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="postmark">
      Select the **Postmark** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="gitlab">
      Select the **GitLab** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="vercel">
      Select the **Vercel** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="cloudflare">
      Select the **Cloudflare** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="supabase">
      Select the **Supabase** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="npm">
      Select the **npm** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="github-npm">
      Select the **GitHub Packages** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="datadog">
      Select the **Datadog** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="sentry">
      Select the **Sentry** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="pagerduty">
      Select the **PagerDuty** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="linear">
      Select the **Linear** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="notion">
      Select the **Notion** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="jira">
      Select the **Jira** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="google-workspace">
      Select the **Google Workspace** template.
    </AgentVaultBranch>

    <AgentVaultBranch service="shopify">
      Select the **Shopify** template.
    </AgentVaultBranch>

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/service-template-picker.png" alt="The Choose a template panel with GitHub among the available services" />
    </Frame>

    <AgentVaultBranch service="none">
      <Note>
        If the API you want to access isn't on the template list, pick **Custom** and set the host, header name, and prefix yourself. For more information, check out the [services](/docs/documentation/platform/agent-vault/services) documentation.
      </Note>
    </AgentVaultBranch>
  </Step>

  <Step>
    <AgentVaultBranch service="github">
      The template fills in the host and header. Paste a [GitHub personal access token](https://github.com/settings/tokens) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="slack">
      The template fills in the host and header. Paste a [Slack bot token](https://api.slack.com/authentication/token-types#bot) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="anthropic">
      The template fills in the host and header. Paste an [Anthropic API key](https://console.anthropic.com/settings/keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="openai">
      The template fills in the host and header. Paste an [OpenAI API key](https://platform.openai.com/api-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="custom">
      Fill in the **Host**, **Header name**, and any **Prefix** the API expects. Then paste your credential in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="none">
      Follow the steps to set up the service. The template automatically fills in most fields, including:

      * The host (for example, `api.github.com`)
      * The header the API expects (for example, `Authorization: Bearer <token>`)

      Paste your credentials in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="gemini">
      The template fills in the host and header. Paste a [Google Gemini API key](https://aistudio.google.com/apikey) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="mistral">
      The template fills in the host and header. Paste a [Mistral AI API key](https://console.mistral.ai/api-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="cohere">
      The template fills in the host and header. Paste a [Cohere API key](https://dashboard.cohere.com/api-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="groq">
      The template fills in the host and header. Paste a [Groq API key](https://console.groq.com/keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="perplexity">
      The template fills in the host and header. Paste a [Perplexity API key](https://www.perplexity.ai/settings/api) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="openrouter">
      The template fills in the host and header. Paste an [OpenRouter API key](https://openrouter.ai/keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="together">
      The template fills in the host and header. Paste a [Together AI API key](https://api.together.xyz/settings/api-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="deepseek">
      The template fills in the host and header. Paste a [DeepSeek API key](https://platform.deepseek.com/api_keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="xai">
      The template fills in the host and header. Paste an [xAI API key](https://console.x.ai/) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="fireworks">
      The template fills in the host and header. Paste a [Fireworks AI API key](https://app.fireworks.ai/settings/users/api-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="stripe">
      The template fills in the host and header. Paste a [Stripe secret key](https://dashboard.stripe.com/apikeys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="twilio">
      The template fills in the host and header. Paste a [Twilio account SID and auth token](https://console.twilio.com/) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="sendgrid">
      The template fills in the host and header. Paste a [SendGrid API key](https://app.sendgrid.com/settings/api_keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="resend">
      The template fills in the host and header. Paste a [Resend API key](https://resend.com/api-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="discord">
      The template fills in the host and header. Paste a [Discord bot token](https://discord.com/developers/applications) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="postmark">
      The template fills in the host and header. Paste a [Postmark server token](https://account.postmarkapp.com/servers) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="gitlab">
      The template fills in the host and header. Paste a [GitLab personal access token](https://gitlab.com/-/user_settings/personal_access_tokens) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="vercel">
      The template fills in the host and header. Paste a [Vercel API token](https://vercel.com/account/tokens) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="cloudflare">
      The template fills in the host and header. Paste a [Cloudflare API token](https://dash.cloudflare.com/profile/api-tokens) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="supabase">
      The template fills in the header and a `<your-project>.supabase.co` host. Replace `<your-project>` with your Supabase project ref, then paste your project's [`anon` or `service_role` API key](https://supabase.com/dashboard) (under **Project Settings** > **API Keys**) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="npm">
      The template fills in the host and header. Paste an [npm access token](https://docs.npmjs.com/creating-and-viewing-access-tokens) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="github-npm">
      The template fills in the host and header. Paste a [GitHub personal access token with the `read:packages` scope](https://github.com/settings/tokens) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="datadog">
      The template fills in the host and header. Paste a [Datadog API key](https://app.datadoghq.com/organization-settings/api-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="sentry">
      The template fills in the host and header. Paste a [Sentry auth token](https://sentry.io/settings/account/api/auth-tokens/) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="pagerduty">
      The template fills in the host and header. Paste a [PagerDuty API access key](https://support.pagerduty.com/main/docs/api-access-keys) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="linear">
      The template fills in the host and header. Paste a [Linear API key](https://linear.app/settings/api) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="notion">
      The template fills in the host and header. Paste a [Notion integration token](https://www.notion.so/profile/integrations) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="jira">
      The template fills in the header and a `<your-tenant>.atlassian.net` host. Replace `<your-tenant>` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`), then paste your [Jira email and API token](https://id.atlassian.com/manage-profile/security/api-tokens) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="google-workspace">
      The template fills in the host and header. Paste a [Google Workspace OAuth token](https://developers.google.com/workspace/guides/create-credentials) in the **Credential** section.
    </AgentVaultBranch>

    <AgentVaultBranch service="shopify">
      The template fills in the header and a `<your-store>.myshopify.com` host. Replace `<your-store>` with your Shopify store subdomain, then paste your [Shopify Admin API access token](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens) in the **Credential** section.
    </AgentVaultBranch>
  </Step>

  <Step>
    Once you've configured the service, select **Add Service**.
  </Step>
</Steps>

<Tip>
  You can repeat these steps to add as many more services as you like to the access bundle.
</Tip>

### Enroll a proxy

Next, enroll a [proxy](/docs/documentation/platform/agent-vault/proxies) to intercept API calls from your agent.

<Steps>
  <Step>
    Go to **Proxies** and select **Create Proxy**.
  </Step>

  <Step>
    Give the proxy a **Name**, then select **Create**. This creates a one-time enrollment token. Copy the command shown—you'll need it in the next step.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/proxy-enrollment-token.png" alt="The Enrollment Token dialog with the CLI command, and Docker and systemd tabs alongside it" />
    </Frame>
  </Step>

  <Step>
    On the host that will act as the proxy, run the command from the previous step.

    ```bash theme={"dark"}
    infisical agent-vault proxy --enrollment-token <enrollment-token>
    ```

    This enrolls the proxy, which starts listening on port `17323`. Leave it running and note this host's address—you'll need it when launching your agent.
  </Step>
</Steps>

<Note>
  This runs the proxy in your current terminal, so the proxy stops when the terminal closes. For a persistent setup, use the **Docker** or **systemd** snippet from the enrollment dialog.

  Check out the [proxies documentation](/docs/documentation/platform/agent-vault/proxies) for more information.
</Note>

### Create a session

Next, create a [session](/docs/documentation/platform/agent-vault/sessions) with your access bundle attached.

<Steps>
  <Step>
    Go to **Sessions** and select **Create Session**.
  </Step>

  <Step>
    Pick the **Access Bundle** the agent should use, set a duration under **Expires**, then select **Create Session**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/session-create.png" alt="The Create Session dialog with code-review picked and a seven day expiry" />
    </Frame>
  </Step>

  <Step>
    This creates the session and gives you a command to run your agent with it. Copy the command—you'll need it in the next step.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/session-created.png" alt="The Session Created dialog showing the infisical agent-vault run command with the session token" />
    </Frame>
  </Step>
</Steps>

## Step 2: Launch your agent

On the host where the agent runs, paste the command you copied in the previous step. Replace `<proxy-host>` with your host's actual domain or IP address, and `<agent-command>` with your agent's own command.

<AgentVaultBranch agent="none">
  For example, with Claude:

  ```bash theme={"dark"}
  infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- claude
  ```
</AgentVaultBranch>

<AgentVaultBranch agent="claude-code">
  For Claude Code, the command is `claude`:

  ```bash theme={"dark"}
  infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- claude
  ```
</AgentVaultBranch>

<AgentVaultBranch agent="codex">
  For Codex, the command is `codex`:

  ```bash theme={"dark"}
  infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- codex
  ```
</AgentVaultBranch>

<AgentVaultBranch agent="opencode">
  For OpenCode, the command is `opencode`:

  ```bash theme={"dark"}
  infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- opencode
  ```
</AgentVaultBranch>

The CLI adds the proxy's certificate authority to the agent process' trusted CAs and starts the agent with its HTTP traffic routed through the proxy. Any calls to services in your access bundle leave the proxy with the real credential attached, while calls to any other host go out normally.

<Note>
  On macOS, you'll need to enter your user password when running your agent for the first time. This is because macOS needs your approval to add the proxy's certificate to your keychain.
</Note>

## Step 3: Verify it works

<AgentVaultBranch service="none">
  To confirm the proxy is attaching credentials, make a test call to a service you configured. Pick an authenticated endpoint on that service (for example, one that returns your account), and make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="anthropic">
  To confirm the proxy is attaching credentials, make a call to Anthropic. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="cloudflare">
  To confirm the proxy is attaching credentials, make a call to Cloudflare. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="cohere">
  To confirm the proxy is attaching credentials, make a call to Cohere. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="datadog">
  To confirm the proxy is attaching credentials, make a call to Datadog. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="deepseek">
  To confirm the proxy is attaching credentials, make a call to DeepSeek. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="discord">
  To confirm the proxy is attaching credentials, make a call to Discord. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="fireworks">
  To confirm the proxy is attaching credentials, make a call to Fireworks AI. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="github">
  To confirm the proxy is attaching credentials, make a call to GitHub. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="github-npm">
  To confirm the proxy is attaching credentials, make a call to GitHub Packages. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="gitlab">
  To confirm the proxy is attaching credentials, make a call to GitLab. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="gemini">
  To confirm the proxy is attaching credentials, make a call to Google Gemini. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="google-workspace">
  To confirm the proxy is attaching credentials, make a call to Google Workspace. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="groq">
  To confirm the proxy is attaching credentials, make a call to Groq. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="jira">
  To confirm the proxy is attaching credentials, make a call to Jira. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="linear">
  To confirm the proxy is attaching credentials, make a call to Linear. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="mistral">
  To confirm the proxy is attaching credentials, make a call to Mistral AI. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="notion">
  To confirm the proxy is attaching credentials, make a call to Notion. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="npm">
  To confirm the proxy is attaching credentials, make a call to npm. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="openai">
  To confirm the proxy is attaching credentials, make a call to OpenAI. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="openrouter">
  To confirm the proxy is attaching credentials, make a call to OpenRouter. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="pagerduty">
  To confirm the proxy is attaching credentials, make a call to PagerDuty. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="perplexity">
  To confirm the proxy is attaching credentials, make a call to Perplexity. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="postmark">
  To confirm the proxy is attaching credentials, make a call to Postmark. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="resend">
  To confirm the proxy is attaching credentials, make a call to Resend. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="sendgrid">
  To confirm the proxy is attaching credentials, make a call to SendGrid. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="sentry">
  To confirm the proxy is attaching credentials, make a call to Sentry. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="shopify">
  To confirm the proxy is attaching credentials, make a call to Shopify. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="slack">
  To confirm the proxy is attaching credentials, make a call to Slack. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="stripe">
  To confirm the proxy is attaching credentials, make a call to Stripe. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="supabase">
  To confirm the proxy is attaching credentials, make a call to Supabase. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="together">
  To confirm the proxy is attaching credentials, make a call to Together AI. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="twilio">
  To confirm the proxy is attaching credentials, make a call to Twilio. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="vercel">
  To confirm the proxy is attaching credentials, make a call to Vercel. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="xai">
  To confirm the proxy is attaching credentials, make a call to xAI. Make the call one of two ways:
</AgentVaultBranch>

<AgentVaultBranch service="custom">
  To confirm the proxy is attaching credentials, make a call to the API you configured. Make the call one of two ways:
</AgentVaultBranch>

<Tabs>
  <Tab title="With your agent">
    In your running agent's session, ask it to make the call. For example:

    <AgentVaultBranch service="none">
      > Run `curl -sS <endpoint-url>` and show me the output.

      The API should respond successfully. The agent doesn't need any real API credentials because the proxy attaches the credential as the request passes through. Run the same command outside the agent, and it fails with an authentication error.
    </AgentVaultBranch>

    <AgentVaultBranch service="github">
      > Run `curl -sS https://api.github.com/user` and show me the output.

      GitHub returns your account. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="slack">
      > Run `curl -sS https://slack.com/api/auth.test` and show me the output.

      Slack returns your workspace and user IDs. Run the same request outside the agent and it returns `not_authed`.
    </AgentVaultBranch>

    <AgentVaultBranch service="anthropic">
      > Run `curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01"` and show me the output.

      Anthropic returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="openai">
      > Run `curl -sS https://api.openai.com/v1/models` and show me the output.

      OpenAI returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch serviceNot="anthropic,cloudflare,cohere,datadog,deepseek,discord,fireworks,gemini,github,github-npm,gitlab,google-workspace,groq,jira,linear,mistral,none,notion,npm,openai,openrouter,pagerduty,perplexity,postmark,resend,sendgrid,sentry,shopify,slack,stripe,supabase,together,twilio,vercel,xai">
      Ask the agent to hit an authenticated endpoint. The proxy attaches the credential as the request passes through, so the agent needs no real token. Run the same request outside the agent and it should fail with an authentication error.
    </AgentVaultBranch>

    <AgentVaultBranch service="gemini">
      > Run `curl -sS https://generativelanguage.googleapis.com/v1beta/models` and show me the output.

      Google Gemini returns the list of available models. Run the same request outside the agent and it fails with a 403.
    </AgentVaultBranch>

    <AgentVaultBranch service="mistral">
      > Run `curl -sS https://api.mistral.ai/v1/models` and show me the output.

      Mistral AI returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="cohere">
      > Run `curl -sS https://api.cohere.com/v1/models` and show me the output.

      Cohere returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="groq">
      > Run `curl -sS https://api.groq.com/openai/v1/models` and show me the output.

      Groq returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="deepseek">
      > Run `curl -sS https://api.deepseek.com/v1/models` and show me the output.

      DeepSeek returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="openrouter">
      > Run `curl -sS https://openrouter.ai/api/v1/credits` and show me the output.

      OpenRouter returns your credit balance. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="together">
      > Run `curl -sS https://api.together.xyz/v1/models` and show me the output.

      Together AI returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="xai">
      > Run `curl -sS https://api.x.ai/v1/models` and show me the output.

      xAI returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="fireworks">
      > Run `curl -sS https://api.fireworks.ai/inference/v1/models` and show me the output.

      Fireworks AI returns the list of available models. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="perplexity">
      > Run `curl -sS https://api.perplexity.ai/async/chat/completions` and show me the output.

      Perplexity returns the list of your async requests. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="cloudflare">
      > Run `curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify` and show me the output.

      Cloudflare returns your token's status. Run the same request outside the agent and it fails with a 400.
    </AgentVaultBranch>

    <AgentVaultBranch service="datadog">
      > Run `curl -sS https://api.datadoghq.com/api/v1/validate` and show me the output.

      Datadog confirms your API key is valid. Run the same request outside the agent and it fails with a 403.
    </AgentVaultBranch>

    <AgentVaultBranch service="discord">
      > Run `curl -sS https://discord.com/api/v10/users/@me` and show me the output.

      Discord returns your bot user. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="gitlab">
      > Run `curl -sS https://gitlab.com/api/v4/user` and show me the output.

      GitLab returns your user profile. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="github-npm">
      > Run `curl -sS https://npm.pkg.github.com/-/whoami` and show me the output.

      GitHub Packages returns your npm username, confirming the token is valid. Run the same request outside the agent and it fails with a 403.
    </AgentVaultBranch>

    <AgentVaultBranch service="notion">
      > Run `curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28"` and show me the output.

      Notion returns your bot user. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="npm">
      > Run `curl -sS https://registry.npmjs.org/-/whoami` and show me the output.

      npm returns your username. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="pagerduty">
      > Run `curl -sS https://api.pagerduty.com/users/me` and show me the output.

      PagerDuty returns your user profile. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="postmark">
      > Run `curl -sS https://api.postmarkapp.com/server` and show me the output.

      Postmark returns your server's info. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="resend">
      > Run `curl -sS https://api.resend.com/api-keys` and show me the output.

      Resend returns your API keys. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="sendgrid">
      > Run `curl -sS https://api.sendgrid.com/v3/user/account` and show me the output.

      SendGrid returns your account info. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="sentry">
      > Run `curl -sS https://sentry.io/api/0/organizations/` and show me the output.

      Sentry returns the organizations your token can access. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="stripe">
      > Run `curl -sS https://api.stripe.com/v1/account` and show me the output.

      Stripe returns your account. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="vercel">
      > Run `curl -sS https://api.vercel.com/v2/user` and show me the output.

      Vercel returns your user profile. Run the same request outside the agent and it fails with a 403.
    </AgentVaultBranch>

    <AgentVaultBranch service="google-workspace">
      Ask the agent to make a call to a Google Workspace API. For example:

      <CodeGroup>
        ```bash Gmail theme={"dark"}
        curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile
        ```

        ```bash Google Calendar theme={"dark"}
        curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList
        ```

        ```bash Google Drive theme={"dark"}
        curl -sS https://www.googleapis.com/drive/v3/about?fields=user
        ```
      </CodeGroup>

      Google returns your Gmail profile, calendars, or Drive info depending on the endpoint. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="jira">
      <Note>Replace `<your-tenant>` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`).</Note>

      > Run `curl -sS https://<your-tenant>.atlassian.net/rest/api/3/myself` and show me the output.

      Jira returns your user profile. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="twilio">
      <Note>Replace `<your-account-sid>` with your Twilio Account SID from the [Twilio console](https://console.twilio.com/).</Note>

      > Run `curl -sS https://api.twilio.com/2010-04-01/Accounts/<your-account-sid>.json` and show me the output.

      Twilio returns your account. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="shopify">
      <Note>Replace `<your-store>` with your Shopify store subdomain (for example, `mystore` from `mystore.myshopify.com`).</Note>

      > Run `curl -sS https://<your-store>.myshopify.com/admin/api/2024-01/shop.json` and show me the output.

      Shopify returns your shop info. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="supabase">
      <Note>Replace `<your-project>` with your Supabase project ref from the [project settings](https://supabase.com/dashboard).</Note>

      > Run `curl -sS https://<your-project>.supabase.co/rest/v1/` and show me the output.

      Supabase returns the OpenAPI schema for your project. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>

    <AgentVaultBranch service="linear">
      > Run `curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}'` and show me the output.

      Linear returns your user info. Run the same request outside the agent and it fails with a 401.
    </AgentVaultBranch>
  </Tab>

  <Tab title="With `curl`">
    Any HTTP client works the same way. Run it through the proxy in place of your agent's command:

    <AgentVaultBranch serviceNot="anthropic,cloudflare,cohere,datadog,deepseek,discord,fireworks,gemini,github,github-npm,gitlab,google-workspace,groq,jira,linear,mistral,notion,npm,openai,openrouter,pagerduty,perplexity,postmark,resend,sendgrid,sentry,shopify,slack,stripe,supabase,together,twilio,vercel,xai">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS <endpoint-url>
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="github">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.github.com/user
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="slack">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://slack.com/api/auth.test
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="anthropic">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01"
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="openai">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.openai.com/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="gemini">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://generativelanguage.googleapis.com/v1beta/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="mistral">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.mistral.ai/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="cohere">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.cohere.com/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="groq">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.groq.com/openai/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="deepseek">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.deepseek.com/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="openrouter">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://openrouter.ai/api/v1/credits
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="together">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.together.xyz/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="xai">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.x.ai/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="fireworks">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.fireworks.ai/inference/v1/models
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="perplexity">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.perplexity.ai/async/chat/completions
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="cloudflare">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="datadog">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.datadoghq.com/api/v1/validate
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="discord">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://discord.com/api/v10/users/@me
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="gitlab">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://gitlab.com/api/v4/user
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="github-npm">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://npm.pkg.github.com/-/whoami
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="notion">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28"
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="npm">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://registry.npmjs.org/-/whoami
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="pagerduty">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.pagerduty.com/users/me
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="postmark">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.postmarkapp.com/server
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="resend">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.resend.com/api-keys
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="sendgrid">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.sendgrid.com/v3/user/account
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="sentry">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://sentry.io/api/0/organizations/
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="stripe">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.stripe.com/v1/account
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="vercel">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.vercel.com/v2/user
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="google-workspace">
      <CodeGroup>
        ```bash Gmail theme={"dark"}
        infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile
        ```

        ```bash Google Calendar theme={"dark"}
        infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList
        ```

        ```bash Google Drive theme={"dark"}
        infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://www.googleapis.com/drive/v3/about?fields=user
        ```
      </CodeGroup>
    </AgentVaultBranch>

    <AgentVaultBranch service="jira">
      <Note>Replace `<your-tenant>` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`).</Note>

      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://<your-tenant>.atlassian.net/rest/api/3/myself
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="twilio">
      <Note>Replace `<your-account-sid>` with your Twilio Account SID.</Note>

      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.twilio.com/2010-04-01/Accounts/<your-account-sid>.json
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="shopify">
      <Note>Replace `<your-store>` with your Shopify store subdomain.</Note>

      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://<your-store>.myshopify.com/admin/api/2024-01/shop.json
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="supabase">
      <Note>Replace `<your-project>` with your Supabase project ref.</Note>

      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://<your-project>.supabase.co/rest/v1/
      ```
    </AgentVaultBranch>

    <AgentVaultBranch service="linear">
      ```bash theme={"dark"}
      infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}'
      ```
    </AgentVaultBranch>

    The proxy logs the request as `brokered`.
  </Tab>
</Tabs>

<AgentVaultBranch service="none,custom">
  <Check>
    Your agent now has a session where it can make authenticated calls to an API without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="github">
  <Check>
    Your agent now has a session where it can call GitHub without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="slack">
  <Check>
    Your agent now has a session where it can call Slack without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="anthropic">
  <Check>
    Your agent now has a session where it can call the Anthropic API without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="openai">
  <Check>
    Your agent now has a session where it can call the OpenAI API without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="gemini">
  <Check>
    Your agent now has a session where it can call Google Gemini without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="mistral">
  <Check>
    Your agent now has a session where it can call Mistral AI without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="cohere">
  <Check>
    Your agent now has a session where it can call Cohere without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="groq">
  <Check>
    Your agent now has a session where it can call Groq without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="perplexity">
  <Check>
    Your agent now has a session where it can call Perplexity without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="openrouter">
  <Check>
    Your agent now has a session where it can call OpenRouter without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="together">
  <Check>
    Your agent now has a session where it can call Together AI without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="deepseek">
  <Check>
    Your agent now has a session where it can call DeepSeek without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="xai">
  <Check>
    Your agent now has a session where it can call xAI without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="fireworks">
  <Check>
    Your agent now has a session where it can call Fireworks AI without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="stripe">
  <Check>
    Your agent now has a session where it can call Stripe without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="twilio">
  <Check>
    Your agent now has a session where it can call Twilio without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="sendgrid">
  <Check>
    Your agent now has a session where it can call SendGrid without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="resend">
  <Check>
    Your agent now has a session where it can call Resend without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="discord">
  <Check>
    Your agent now has a session where it can call Discord without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="postmark">
  <Check>
    Your agent now has a session where it can call Postmark without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="gitlab">
  <Check>
    Your agent now has a session where it can call GitLab without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="vercel">
  <Check>
    Your agent now has a session where it can call Vercel without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="cloudflare">
  <Check>
    Your agent now has a session where it can call Cloudflare without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="supabase">
  <Check>
    Your agent now has a session where it can call Supabase without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="npm">
  <Check>
    Your agent now has a session where it can call npm without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="github-npm">
  <Check>
    Your agent now has a session where it can call GitHub Packages without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="datadog">
  <Check>
    Your agent now has a session where it can call Datadog without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="sentry">
  <Check>
    Your agent now has a session where it can call Sentry without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="pagerduty">
  <Check>
    Your agent now has a session where it can call PagerDuty without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="linear">
  <Check>
    Your agent now has a session where it can call Linear without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="notion">
  <Check>
    Your agent now has a session where it can call Notion without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="jira">
  <Check>
    Your agent now has a session where it can call Jira without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="google-workspace">
  <Check>
    Your agent now has a session where it can call Google Workspace without ever seeing a real token.
  </Check>
</AgentVaultBranch>

<AgentVaultBranch service="shopify">
  <Check>
    Your agent now has a session where it can call Shopify without ever seeing a real token.
  </Check>
</AgentVaultBranch>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication error from the upstream API">
    The credential wasn't applied. Open your access bundle and confirm a service covers the host you called. If one does, the stored token is likely wrong.
  </Accordion>

  <Accordion title="407 from the proxy">
    The session token was missing from the request. Confirm you passed `--session-token`, or that the token appears as the userinfo in your `HTTPS_PROXY` URL (like `http://x-agent-vault:<session-token>@<proxy-address>`).
  </Accordion>

  <Accordion title="403 from the proxy">
    This could be for a few reasons:

    * The session was revoked or has expired (check the **Sessions** page in Infisical, and create a new one if needed)
    * Under the proxy's [strict traffic policy](/docs/documentation/platform/agent-vault/proxies#traffic-policy), no service in the bundle covers the host you called (add a service that does, or use a pass-through service)
    * The service covers the host, but doesn't allow the request's method or path (check the service's [methods and paths](/docs/documentation/platform/agent-vault/services#methods-and-paths))
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Access bundles" icon="box" href="/docs/documentation/platform/agent-vault/access-bundles">
    Lists of services that AI agents can access during a session.
  </Card>

  <Card title="Sessions" icon="monitor" href="/docs/documentation/platform/agent-vault/sessions">
    Time-bound grants that let AI agents access services without holding real credentials.
  </Card>

  <Card title="Proxies" icon="route" href="/docs/documentation/platform/agent-vault/proxies">
    Forward proxies that intercept an AI agent's requests and attach real credentials on the way out.
  </Card>

  <Card title="CLI reference" icon="terminal" href="/docs/cli/commands/agent-vault">
    Every flag of `infisical agent-vault proxy` and `infisical agent-vault run`.
  </Card>
</CardGroup>