Set up credentials

Every Agent Proxy setup starts with the same two things in Infisical: a secret holding the real credential, and a proxied service saying which host that credential is applied to. This page adds the secret and checks that the folder has a proxied service, then points you at the setup that matches where your agent runs. GitHub is this guide’s running example. Any other API works the same way, and the steps are identical.

​

Before you begin

• An Infisical Secrets Management project.
• A GitHub account, to create the token you’ll broker.

​

1. Add a secret

First, get a GitHub personal access token to broker:

1. Go to GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens.
2. Select Generate new token, give it a name, set an expiration, and choose the resource owner.
3. Leave the permissions at their defaults. The check at the end of this guide calls GET /user, which any valid token can reach, so no permissions are needed here; later, grant only what your agent actually does.
4. Select Generate token and copy the github_pat_… value. GitHub only shows it once.

Then, in your Infisical project, create a folder for the agent (for example /coding-agent in the dev environment) and add a secret named GITHUB_PAT with that token as its value. It’s a regular Infisical secret.

​

2. Check for a proxied service

If the folder already has a proxied service for api.github.com, continue to pick where the proxy runs. If it doesn’t, set up your agent with the Agent Vault quickstart instead, because you can’t create new proxied services.

​

3. Pick where the proxy runs

The proxy has to sit between your agent and the internet, so where it runs follows from where your agent runs. Pick the one that matches yours and follow it to the end; each is a complete walkthrough that continues from here.