> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Agent Vault with OpenCode > Launch OpenCode with Agent Vault so it can make authenticated API calls without needing an actual token. export const AgentVaultBranch = ({service, agent, serviceNot, agentNot, children}) => { const SELECTION_EVENT = "av-quickstart-selection-change"; const KNOWN_SERVICE_IDS = new Set(["anthropic", "cloudflare", "cohere", "custom", "datadog", "deepseek", "discord", "fireworks", "gemini", "github", "github-npm", "gitlab", "google-workspace", "groq", "jira", "linear", "mistral", "notion", "npm", "openai", "openrouter", "pagerduty", "perplexity", "postmark", "resend", "sendgrid", "sentry", "shopify", "slack", "stripe", "supabase", "together", "twilio", "vercel", "xai"]); const KNOWN_AGENT_IDS = new Set(["claude-code", "codex", "opencode"]); const [selection, setSelection] = useState({ service: null, agent: null }); useEffect(() => { const sync = () => { const params = new URLSearchParams(window.location.search); setSelection({ service: (() => { const v = params.get("service"); return v && KNOWN_SERVICE_IDS.has(v) ? v : null; })(), agent: (() => { const v = params.get("agent"); return v && KNOWN_AGENT_IDS.has(v) ? v : null; })() }); }; sync(); window.addEventListener(SELECTION_EVENT, sync); window.addEventListener("popstate", sync); return () => { window.removeEventListener(SELECTION_EVENT, sync); window.removeEventListener("popstate", sync); }; }, []); const parseList = raw => raw ? String(raw).split(",").map(entry => entry.trim()).filter(Boolean) : []; const matchesService = useMemo(() => { const current = selection.service ?? "none"; if (service !== undefined && service !== null) { const wanted = parseList(service); if (wanted.length === 0) return true; if (!wanted.includes(current)) return false; } const excluded = parseList(serviceNot); if (excluded.includes(current)) return false; return true; }, [selection.service, service, serviceNot]); const matchesAgent = useMemo(() => { const current = selection.agent ?? "none"; if (agent !== undefined && agent !== null) { const wanted = parseList(agent); if (wanted.length === 0) return true; if (!wanted.includes(current)) return false; } const excluded = parseList(agentNot); if (excluded.includes(current)) return false; return true; }, [selection.agent, agent, agentNot]); if (!matchesService || !matchesAgent) return null; return <>{children}; }; export const AgentGuideInit = ({agent}) => { if (typeof window !== "undefined") { const params = new URLSearchParams(window.location.search); if (params.get("agent") !== agent) { params.set("agent", agent); const query = params.toString(); const next = `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`; window.history.replaceState({}, "", next); window.dispatchEvent(new Event("av-quickstart-selection-change")); } } return null; }; export const AgentVaultQuickstartPicker = () => { const SERVICE_ICONS = { github: , slack: , anthropic: , openai: , "gemini": , "mistral": , "cohere": , "groq": , "perplexity": , "openrouter": , "together": , "deepseek": , "xai": , "fireworks": , "stripe": , "twilio": , "sendgrid": , "resend": , "discord": , "postmark": , "gitlab": , "vercel": , "cloudflare": , "supabase": , "npm": , "github-npm": , "datadog": , "sentry": , "pagerduty": , "linear": , "notion": , "jira": , "google-workspace": , "shopify": }; const AGENT_ICONS = { "claude-code": , codex: , opencode: }; const KNOWN_SERVICE_IDS = new Set(["anthropic", "cloudflare", "cohere", "custom", "datadog", "deepseek", "discord", "fireworks", "gemini", "github", "github-npm", "gitlab", "google-workspace", "groq", "jira", "linear", "mistral", "notion", "npm", "openai", "openrouter", "pagerduty", "perplexity", "postmark", "resend", "sendgrid", "sentry", "shopify", "slack", "stripe", "supabase", "together", "twilio", "vercel", "xai"]); const KNOWN_AGENT_IDS = new Set(["claude-code", "codex", "opencode"]); const SERVICES = [{ id: "anthropic", label: "Anthropic", chip: "Anthropic" }, { id: "cloudflare", label: "Cloudflare", chip: "Cloudflare" }, { id: "cohere", label: "Cohere", chip: "Cohere" }, { id: "datadog", label: "Datadog", chip: "Datadog" }, { id: "deepseek", label: "DeepSeek", chip: "DeepSeek" }, { id: "discord", label: "Discord", chip: "Discord" }, { id: "fireworks", label: "Fireworks AI", chip: "Fireworks AI" }, { id: "github", label: "GitHub", chip: "GitHub" }, { id: "github-npm", label: "GitHub Packages", chip: "GitHub Packages" }, { id: "gitlab", label: "GitLab", chip: "GitLab" }, { id: "gemini", label: "Google Gemini", chip: "Google Gemini" }, { id: "google-workspace", label: "Google Workspace", chip: "Google Workspace" }, { id: "groq", label: "Groq", chip: "Groq" }, { id: "jira", label: "Jira", chip: "Jira" }, { id: "linear", label: "Linear", chip: "Linear" }, { id: "mistral", label: "Mistral AI", chip: "Mistral AI" }, { id: "notion", label: "Notion", chip: "Notion" }, { id: "npm", label: "npm", chip: "npm" }, { id: "openai", label: "OpenAI", chip: "OpenAI" }, { id: "openrouter", label: "OpenRouter", chip: "OpenRouter" }, { id: "pagerduty", label: "PagerDuty", chip: "PagerDuty" }, { id: "perplexity", label: "Perplexity", chip: "Perplexity" }, { id: "postmark", label: "Postmark", chip: "Postmark" }, { id: "resend", label: "Resend", chip: "Resend" }, { id: "sendgrid", label: "SendGrid", chip: "SendGrid" }, { id: "sentry", label: "Sentry", chip: "Sentry" }, { id: "shopify", label: "Shopify", chip: "Shopify" }, { id: "slack", label: "Slack", chip: "Slack" }, { id: "stripe", label: "Stripe", chip: "Stripe" }, { id: "supabase", label: "Supabase", chip: "Supabase" }, { id: "together", label: "Together AI", chip: "Together AI" }, { id: "twilio", label: "Twilio", chip: "Twilio" }, { id: "vercel", label: "Vercel", chip: "Vercel" }, { id: "xai", label: "xAI", chip: "xAI" }, { id: "custom", label: "Custom", chip: "a custom API" }]; const AGENTS = [{ id: "claude-code", label: "Claude Code", chip: "Claude Code" }, { id: "codex", label: "Codex", chip: "Codex" }, { id: "opencode", label: "OpenCode", chip: "OpenCode" }]; const SELECTION_EVENT = "av-quickstart-selection-change"; const [selection, setSelection] = useState({ service: null, agent: null }); const [openMenu, setOpenMenu] = useState(null); const [searchService, setSearchService] = useState(""); const [searchAgent, setSearchAgent] = useState(""); const rootRef = useRef(null); const serviceButtonRef = useRef(null); const agentButtonRef = useRef(null); const searchInputRef = useRef(null); useEffect(() => { const sync = () => { const params = new URLSearchParams(window.location.search); setSelection({ service: (() => { const v = params.get("service"); return v && KNOWN_SERVICE_IDS.has(v) ? v : null; })(), agent: (() => { const v = params.get("agent"); return v && KNOWN_AGENT_IDS.has(v) ? v : null; })() }); }; sync(); window.addEventListener(SELECTION_EVENT, sync); window.addEventListener("popstate", sync); return () => { window.removeEventListener(SELECTION_EVENT, sync); window.removeEventListener("popstate", sync); }; }, []); useEffect(() => { if (!openMenu) return undefined; const onDown = event => { if (rootRef.current && !rootRef.current.contains(event.target)) { setOpenMenu(null); } }; const onKey = event => { if (event.key === "Escape") { setOpenMenu(null); const target = openMenu === "service" ? serviceButtonRef.current : agentButtonRef.current; if (target) target.focus(); } }; document.addEventListener("mousedown", onDown); document.addEventListener("keydown", onKey); return () => { document.removeEventListener("mousedown", onDown); document.removeEventListener("keydown", onKey); }; }, [openMenu]); useEffect(() => { if (openMenu && searchInputRef.current) { searchInputRef.current.focus(); } }, [openMenu]); const update = (dimension, value) => { const params = new URLSearchParams(window.location.search); if (value === null) params.delete(dimension); else params.set(dimension, value); const query = params.toString(); const next = `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`; window.history.replaceState({}, "", next); window.dispatchEvent(new Event(SELECTION_EVENT)); setOpenMenu(null); setSearchService(""); setSearchAgent(""); }; const reset = () => { const params = new URLSearchParams(window.location.search); params.delete("service"); params.delete("agent"); const query = params.toString(); const next = `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`; window.history.replaceState({}, "", next); window.dispatchEvent(new Event(SELECTION_EVENT)); setOpenMenu(null); }; const activeService = SERVICES.find(option => option.id === selection.service); const activeAgent = AGENTS.find(option => option.id === selection.agent); const hasSelection = Boolean(selection.service || selection.agent); const chevron = ; const renderMenu = (dimension, options, iconMap, activeId, searchValue, setSearch) => { const query = searchValue.trim().toLowerCase(); const filtered = query ? options.filter(option => option.label.toLowerCase().includes(query)) : options; return
setSearch(event.target.value)} />
{filtered.length > 0 ?
{filtered.map(option => )}
:
No matches for “{searchValue}”.
} {activeId && }
; }; return

I want{" "} {openMenu === "agent" && renderMenu("agent", AGENTS, AGENT_ICONS, selection.agent, searchAgent, setSearchAgent)} {" "} to access{" "} {openMenu === "service" && renderMenu("service", SERVICES, SERVICE_ICONS, selection.service, searchService, setSearchService)}

{hasSelection ? <> The steps below match your choice.{" "} : "Pick to view tailored steps, or leave both to read the generic version of the guide."}

; }; This quickstart guide walks you through using Agent Vault to launch an agent that makes authenticated API calls without needing an actual token. ## Prerequisites ## Step 1: Set up in Infisical ### Create an access bundle First, create an [access bundle](/docs/documentation/platform/agent-vault/access-bundles) that defines which APIs ([services](/docs/documentation/platform/agent-vault/services)) the agent can access. In Infisical, open **Agent Vault** from the product switcher and go to **Access Bundles**. Select **Create Access Bundle**. Give the access bundle a **Name**, then select **Create Access Bundle**. The Create Access Bundle dialog with code-review entered as the name Select the access bundle you just created, then select **Add Service**. Find the template for the API you want the agent to access, then select it. Select the **GitHub** template. Select the **Slack** template. Select the **Anthropic** template. Select the **OpenAI** template. Select **Custom**. You'll set the host, header name, and prefix yourself on the next step. Select the **Google Gemini** template. Select the **Mistral AI** template. Select the **Cohere** template. Select the **Groq** template. Select the **Perplexity** template. Select the **OpenRouter** template. Select the **Together AI** template. Select the **DeepSeek** template. Select the **xAI** template. Select the **Fireworks AI** template. Select the **Stripe** template. Select the **Twilio** template. Select the **SendGrid** template. Select the **Resend** template. Select the **Discord** template. Select the **Postmark** template. Select the **GitLab** template. Select the **Vercel** template. Select the **Cloudflare** template. Select the **Supabase** template. Select the **npm** template. Select the **GitHub Packages** template. Select the **Datadog** template. Select the **Sentry** template. Select the **PagerDuty** template. Select the **Linear** template. Select the **Notion** template. Select the **Jira** template. Select the **Google Workspace** template. Select the **Shopify** template. The Choose a template panel with GitHub among the available services If the API you want to access isn't on the template list, pick **Custom** and set the host, header name, and prefix yourself. For more information, check out the [services](/docs/documentation/platform/agent-vault/services) documentation. The template fills in the host and header. Paste a [GitHub personal access token](https://github.com/settings/tokens) in the **Credential** section. The template fills in the host and header. Paste a [Slack bot token](https://api.slack.com/authentication/token-types#bot) in the **Credential** section. The template fills in the host and header. Paste an [Anthropic API key](https://console.anthropic.com/settings/keys) in the **Credential** section. The template fills in the host and header. Paste an [OpenAI API key](https://platform.openai.com/api-keys) in the **Credential** section. Fill in the **Host**, **Header name**, and any **Prefix** the API expects. Then paste your credential in the **Credential** section. Follow the steps to set up the service. The template automatically fills in most fields, including: * The host (for example, `api.github.com`) * The header the API expects (for example, `Authorization: Bearer `) Paste your credentials in the **Credential** section. The template fills in the host and header. Paste a [Google Gemini API key](https://aistudio.google.com/apikey) in the **Credential** section. The template fills in the host and header. Paste a [Mistral AI API key](https://console.mistral.ai/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Cohere API key](https://dashboard.cohere.com/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Groq API key](https://console.groq.com/keys) in the **Credential** section. The template fills in the host and header. Paste a [Perplexity API key](https://www.perplexity.ai/settings/api) in the **Credential** section. The template fills in the host and header. Paste an [OpenRouter API key](https://openrouter.ai/keys) in the **Credential** section. The template fills in the host and header. Paste a [Together AI API key](https://api.together.xyz/settings/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [DeepSeek API key](https://platform.deepseek.com/api_keys) in the **Credential** section. The template fills in the host and header. Paste an [xAI API key](https://console.x.ai/) in the **Credential** section. The template fills in the host and header. Paste a [Fireworks AI API key](https://app.fireworks.ai/settings/users/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Stripe secret key](https://dashboard.stripe.com/apikeys) in the **Credential** section. The template fills in the host and header. Paste a [Twilio account SID and auth token](https://console.twilio.com/) in the **Credential** section. The template fills in the host and header. Paste a [SendGrid API key](https://app.sendgrid.com/settings/api_keys) in the **Credential** section. The template fills in the host and header. Paste a [Resend API key](https://resend.com/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Discord bot token](https://discord.com/developers/applications) in the **Credential** section. The template fills in the host and header. Paste a [Postmark server token](https://account.postmarkapp.com/servers) in the **Credential** section. The template fills in the host and header. Paste a [GitLab personal access token](https://gitlab.com/-/user_settings/personal_access_tokens) in the **Credential** section. The template fills in the host and header. Paste a [Vercel API token](https://vercel.com/account/tokens) in the **Credential** section. The template fills in the host and header. Paste a [Cloudflare API token](https://dash.cloudflare.com/profile/api-tokens) in the **Credential** section. The template fills in the header and a `.supabase.co` host. Replace `` with your Supabase project ref, then paste your project's [`anon` or `service_role` API key](https://supabase.com/dashboard) (under **Project Settings** > **API Keys**) in the **Credential** section. The template fills in the host and header. Paste an [npm access token](https://docs.npmjs.com/creating-and-viewing-access-tokens) in the **Credential** section. The template fills in the host and header. Paste a [GitHub personal access token with the `read:packages` scope](https://github.com/settings/tokens) in the **Credential** section. The template fills in the host and header. Paste a [Datadog API key](https://app.datadoghq.com/organization-settings/api-keys) in the **Credential** section. The template fills in the host and header. Paste a [Sentry auth token](https://sentry.io/settings/account/api/auth-tokens/) in the **Credential** section. The template fills in the host and header. Paste a [PagerDuty API access key](https://support.pagerduty.com/main/docs/api-access-keys) in the **Credential** section. The template fills in the host and header. Paste a [Linear API key](https://linear.app/settings/api) in the **Credential** section. The template fills in the host and header. Paste a [Notion integration token](https://www.notion.so/profile/integrations) in the **Credential** section. The template fills in the header and a `.atlassian.net` host. Replace `` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`), then paste your [Jira email and API token](https://id.atlassian.com/manage-profile/security/api-tokens) in the **Credential** section. The template fills in the host and header. Paste a [Google Workspace OAuth token](https://developers.google.com/workspace/guides/create-credentials) in the **Credential** section. The template fills in the header and a `.myshopify.com` host. Replace `` with your Shopify store subdomain, then paste your [Shopify Admin API access token](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens) in the **Credential** section. Once you've configured the service, select **Add Service**. You can repeat these steps to add as many more services as you like to the access bundle. ### Enroll a proxy Next, enroll a [proxy](/docs/documentation/platform/agent-vault/proxies) to intercept API calls from your agent. Go to **Proxies** and select **Create Proxy**. Give the proxy a **Name**, then select **Create**. This creates a one-time enrollment token. Copy the command shown—you'll need it in the next step. The Enrollment Token dialog with the CLI command, and Docker and systemd tabs alongside it On the host that will act as the proxy, run the command from the previous step. ```bash theme={"dark"} infisical agent-vault proxy --enrollment-token ``` This enrolls the proxy, which starts listening on port `17323`. Leave it running and note this host's address—you'll need it when launching your agent. This runs the proxy in your current terminal, so the proxy stops when the terminal closes. For a persistent setup, use the **Docker** or **systemd** snippet from the enrollment dialog. Check out the [proxies documentation](/docs/documentation/platform/agent-vault/proxies) for more information. ### Create a session Next, create a [session](/docs/documentation/platform/agent-vault/sessions) with your access bundle attached. Go to **Sessions** and select **Create Session**. Pick the **Access Bundle** the agent should use, set a duration under **Expires**, then select **Create Session**. The Create Session dialog with code-review picked and a seven day expiry This creates the session and gives you a command to run your agent with it. Copy the command—you'll need it in the next step. The Session Created dialog showing the infisical agent-vault run command with the session token ## Step 2: Launch your agent On the host where the agent runs, paste the command you copied in the previous step. Replace `` with your host's actual domain or IP address, and `` with your agent's own command. For example, with Claude: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- claude ``` For Claude Code, the command is `claude`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- claude ``` For Codex, the command is `codex`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- codex ``` For OpenCode, the command is `opencode`: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- opencode ``` The CLI adds the proxy's certificate authority to the agent process' trusted CAs and starts the agent with its HTTP traffic routed through the proxy. Any calls to services in your access bundle leave the proxy with the real credential attached, while calls to any other host go out normally. On macOS, you'll need to enter your user password when running your agent for the first time. This is because macOS needs your approval to add the proxy's certificate to your keychain. ## Step 3: Verify it works To confirm the proxy is attaching credentials, make a test call to a service you configured. Pick an authenticated endpoint on that service (for example, one that returns your account), and make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Anthropic. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Cloudflare. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Cohere. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Datadog. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to DeepSeek. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Discord. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Fireworks AI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to GitHub. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to GitHub Packages. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to GitLab. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Google Gemini. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Google Workspace. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Groq. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Jira. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Linear. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Mistral AI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Notion. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to npm. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to OpenAI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to OpenRouter. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to PagerDuty. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Perplexity. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Postmark. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Resend. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to SendGrid. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Sentry. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Shopify. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Slack. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Stripe. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Supabase. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Together AI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Twilio. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to Vercel. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to xAI. Make the call one of two ways: To confirm the proxy is attaching credentials, make a call to the API you configured. Make the call one of two ways: In your running agent's session, ask it to make the call. For example: > Run `curl -sS ` and show me the output. The API should respond successfully. The agent doesn't need any real API credentials because the proxy attaches the credential as the request passes through. Run the same command outside the agent, and it fails with an authentication error. > Run `curl -sS https://api.github.com/user` and show me the output. GitHub returns your account. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://slack.com/api/auth.test` and show me the output. Slack returns your workspace and user IDs. Run the same request outside the agent and it returns `not_authed`. > Run `curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01"` and show me the output. Anthropic returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.openai.com/v1/models` and show me the output. OpenAI returns the list of available models. Run the same request outside the agent and it fails with a 401. Ask the agent to hit an authenticated endpoint. The proxy attaches the credential as the request passes through, so the agent needs no real token. Run the same request outside the agent and it should fail with an authentication error. > Run `curl -sS https://generativelanguage.googleapis.com/v1beta/models` and show me the output. Google Gemini returns the list of available models. Run the same request outside the agent and it fails with a 403. > Run `curl -sS https://api.mistral.ai/v1/models` and show me the output. Mistral AI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.cohere.com/v1/models` and show me the output. Cohere returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.groq.com/openai/v1/models` and show me the output. Groq returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.deepseek.com/v1/models` and show me the output. DeepSeek returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://openrouter.ai/api/v1/credits` and show me the output. OpenRouter returns your credit balance. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.together.xyz/v1/models` and show me the output. Together AI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.x.ai/v1/models` and show me the output. xAI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.fireworks.ai/inference/v1/models` and show me the output. Fireworks AI returns the list of available models. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.perplexity.ai/async/chat/completions` and show me the output. Perplexity returns the list of your async requests. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify` and show me the output. Cloudflare returns your token's status. Run the same request outside the agent and it fails with a 400. > Run `curl -sS https://api.datadoghq.com/api/v1/validate` and show me the output. Datadog confirms your API key is valid. Run the same request outside the agent and it fails with a 403. > Run `curl -sS https://discord.com/api/v10/users/@me` and show me the output. Discord returns your bot user. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://gitlab.com/api/v4/user` and show me the output. GitLab returns your user profile. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://npm.pkg.github.com/-/whoami` and show me the output. GitHub Packages returns your npm username, confirming the token is valid. Run the same request outside the agent and it fails with a 403. > Run `curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28"` and show me the output. Notion returns your bot user. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://registry.npmjs.org/-/whoami` and show me the output. npm returns your username. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.pagerduty.com/users/me` and show me the output. PagerDuty returns your user profile. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.postmarkapp.com/server` and show me the output. Postmark returns your server's info. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.resend.com/api-keys` and show me the output. Resend returns your API keys. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.sendgrid.com/v3/user/account` and show me the output. SendGrid returns your account info. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://sentry.io/api/0/organizations/` and show me the output. Sentry returns the organizations your token can access. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.stripe.com/v1/account` and show me the output. Stripe returns your account. Run the same request outside the agent and it fails with a 401. > Run `curl -sS https://api.vercel.com/v2/user` and show me the output. Vercel returns your user profile. Run the same request outside the agent and it fails with a 403. Ask the agent to make a call to a Google Workspace API. For example: ```bash Gmail theme={"dark"} curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile ``` ```bash Google Calendar theme={"dark"} curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList ``` ```bash Google Drive theme={"dark"} curl -sS https://www.googleapis.com/drive/v3/about?fields=user ``` Google returns your Gmail profile, calendars, or Drive info depending on the endpoint. Run the same request outside the agent and it fails with a 401. Replace `` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`). > Run `curl -sS https://.atlassian.net/rest/api/3/myself` and show me the output. Jira returns your user profile. Run the same request outside the agent and it fails with a 401. Replace `` with your Twilio Account SID from the [Twilio console](https://console.twilio.com/). > Run `curl -sS https://api.twilio.com/2010-04-01/Accounts/.json` and show me the output. Twilio returns your account. Run the same request outside the agent and it fails with a 401. Replace `` with your Shopify store subdomain (for example, `mystore` from `mystore.myshopify.com`). > Run `curl -sS https://.myshopify.com/admin/api/2024-01/shop.json` and show me the output. Shopify returns your shop info. Run the same request outside the agent and it fails with a 401. Replace `` with your Supabase project ref from the [project settings](https://supabase.com/dashboard). > Run `curl -sS https://.supabase.co/rest/v1/` and show me the output. Supabase returns the OpenAPI schema for your project. Run the same request outside the agent and it fails with a 401. > Run `curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}'` and show me the output. Linear returns your user info. Run the same request outside the agent and it fails with a 401. Any HTTP client works the same way. Run it through the proxy in place of your agent's command: ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.github.com/user ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://slack.com/api/auth.test ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01" ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.openai.com/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://generativelanguage.googleapis.com/v1beta/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.mistral.ai/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.cohere.com/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.groq.com/openai/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.deepseek.com/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://openrouter.ai/api/v1/credits ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.together.xyz/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.x.ai/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.fireworks.ai/inference/v1/models ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.perplexity.ai/async/chat/completions ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.datadoghq.com/api/v1/validate ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://discord.com/api/v10/users/@me ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://gitlab.com/api/v4/user ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://npm.pkg.github.com/-/whoami ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28" ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://registry.npmjs.org/-/whoami ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.pagerduty.com/users/me ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.postmarkapp.com/server ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.resend.com/api-keys ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.sendgrid.com/v3/user/account ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://sentry.io/api/0/organizations/ ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.stripe.com/v1/account ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.vercel.com/v2/user ``` ```bash Gmail theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile ``` ```bash Google Calendar theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList ``` ```bash Google Drive theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://www.googleapis.com/drive/v3/about?fields=user ``` Replace `` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`). ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://.atlassian.net/rest/api/3/myself ``` Replace `` with your Twilio Account SID. ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://api.twilio.com/2010-04-01/Accounts/.json ``` Replace `` with your Shopify store subdomain. ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://.myshopify.com/admin/api/2024-01/shop.json ``` Replace `` with your Supabase project ref. ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS https://.supabase.co/rest/v1/ ``` ```bash theme={"dark"} infisical agent-vault run --session-token --proxy :17323 -- curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}' ``` The proxy logs the request as `brokered`. Your agent now has a session where it can make authenticated calls to an API without ever seeing a real token. Your agent now has a session where it can call GitHub without ever seeing a real token. Your agent now has a session where it can call Slack without ever seeing a real token. Your agent now has a session where it can call the Anthropic API without ever seeing a real token. Your agent now has a session where it can call the OpenAI API without ever seeing a real token. Your agent now has a session where it can call Google Gemini without ever seeing a real token. Your agent now has a session where it can call Mistral AI without ever seeing a real token. Your agent now has a session where it can call Cohere without ever seeing a real token. Your agent now has a session where it can call Groq without ever seeing a real token. Your agent now has a session where it can call Perplexity without ever seeing a real token. Your agent now has a session where it can call OpenRouter without ever seeing a real token. Your agent now has a session where it can call Together AI without ever seeing a real token. Your agent now has a session where it can call DeepSeek without ever seeing a real token. Your agent now has a session where it can call xAI without ever seeing a real token. Your agent now has a session where it can call Fireworks AI without ever seeing a real token. Your agent now has a session where it can call Stripe without ever seeing a real token. Your agent now has a session where it can call Twilio without ever seeing a real token. Your agent now has a session where it can call SendGrid without ever seeing a real token. Your agent now has a session where it can call Resend without ever seeing a real token. Your agent now has a session where it can call Discord without ever seeing a real token. Your agent now has a session where it can call Postmark without ever seeing a real token. Your agent now has a session where it can call GitLab without ever seeing a real token. Your agent now has a session where it can call Vercel without ever seeing a real token. Your agent now has a session where it can call Cloudflare without ever seeing a real token. Your agent now has a session where it can call Supabase without ever seeing a real token. Your agent now has a session where it can call npm without ever seeing a real token. Your agent now has a session where it can call GitHub Packages without ever seeing a real token. Your agent now has a session where it can call Datadog without ever seeing a real token. Your agent now has a session where it can call Sentry without ever seeing a real token. Your agent now has a session where it can call PagerDuty without ever seeing a real token. Your agent now has a session where it can call Linear without ever seeing a real token. Your agent now has a session where it can call Notion without ever seeing a real token. Your agent now has a session where it can call Jira without ever seeing a real token. Your agent now has a session where it can call Google Workspace without ever seeing a real token. Your agent now has a session where it can call Shopify without ever seeing a real token. ## Troubleshooting The credential wasn't applied. Open your access bundle and confirm a service covers the host you called. If one does, the stored token is likely wrong. The session token was missing from the request. Confirm you passed `--session-token`, or that the token appears as the userinfo in your `HTTPS_PROXY` URL (like `http://x-agent-vault:@`). This could be for two reasons: * The session was revoked or has expired. Check the Sessions page in Infisical, and create a new one if needed. * Under the proxy's [strict traffic policy](/docs/documentation/platform/agent-vault/proxies#traffic-policy), no service in the bundle covers the host you called. Add a service that does, or use a pass-through service. ## Next steps Lists of services that AI agents can access during a session. Time-bound grants that let AI agents access services without holding real credentials. Forward proxies that intercept an AI agent's requests and attach real credentials on the way out. Every flag of `infisical agent-vault proxy` and `infisical agent-vault run`.