--- title: "Agent Vault" description: "Give AI agents access to HTTP APIs and services without letting them read the credential, with time-bound sessions, scoped access bundles, per-agent identity, and session logs of every request, for Claude Code, Codex, OpenCode, Hermes, OpenClaw, and any HTTPS_PROXY client." canonical: "https://infisical.com/platform/agent-vault" source-index: https://infisical.com/llms.txt --- # Agent Vault Infisical Agent Vault is an access layer for AI agents. It lets an agent call third-party APIs, CLIs, and MCP servers over HTTP without ever holding the credentials. The agent routes its traffic through a forward proxy, authenticates to it with a time-bound session token, and the proxy attaches the real credential to each allowed request as it leaves your network. A prompt-injected agent has nothing to leak, because the credential was never in its environment, files, or context. Agent Vault is a separate product from Infisical Secrets Management, available on Infisical Cloud (US and EU) and self-hosted. It is currently in preview, so features and pricing may change. Use this when an AI agent needs to call an external service with a credential. When application code needs a secret at runtime, that is [Secrets Management](https://infisical.com/platform/secrets-management.md). When an agent needs a session on your own database or server, that is [PAM agentic access](https://infisical.com/platform/pam.md). ## How you use it Four objects make up Agent Vault. A **service** is one external API with its real credential. An **access bundle** is a named list of services granted as a unit, usually one per job (for example `code-review`: GitHub, Slack, Anthropic). A **session** is a time-bound grant on one access bundle, represented by a session token. A **proxy** is the forward proxy you run where agent traffic leaves your network. | Interface | Use it when | Entry point | |---|---|---| | **CLI** | Launching an agent behind the proxy | `infisical agent-vault run --session-token --proxy :17323 -- claude` | | **CLI, self-serve session** | A user or machine identity starts its own agent | `infisical agent-vault run --access-bundle --proxy :17323 --ttl 8h -- codex` | | **Proxy** | Enrolling the proxy once, by CLI, Docker, or systemd | `infisical agent-vault proxy --enrollment-token ` | | **Plain `HTTPS_PROXY`** | Containers or harnesses started without the CLI | `HTTPS_PROXY=http://x-agent-vault:@:17323` | | **Dashboard** | Admins defining services, bundles, grants, and proxies | Agent Vault in the Infisical product switcher | | **REST API** | Automating sessions, bundles, services, proxies, and log export | [API reference](https://infisical.com/docs/api-reference/endpoints/agent-vault-sessions/create) | `av` is an alias: `infisical av run` works the same as `infisical agent-vault run`. ## What you can do with it **Keep credentials out of the agent.** The real credential stays in Infisical. The proxy attaches it as an `Authorization: Bearer` header, a custom header such as `X-API-Key`, or HTTP basic auth, and replaces any header the agent sent with the same name. If the agent's tool refuses to start without a token, give it a placeholder like `__GITHUB_PAT__` and the proxy substitutes the real value in the URL path, query string, headers, or body. [Services](https://infisical.com/docs/documentation/platform/agent-vault/services): credential types, host patterns, substitutions, and custom headers. **Scope each agent to the job.** An access bundle lists exactly the services one kind of task needs, and each service can be narrowed to specific HTTP methods and path prefixes. A request that breaks those rules gets a `403` before it leaves your network. Set the proxy's traffic policy to **Access bundle hosts only** and every host outside the bundle is refused too, except for exceptions you name, such as a package registry. [Access bundles](https://infisical.com/docs/documentation/platform/agent-vault/access-bundles) and [traffic policy](https://infisical.com/docs/documentation/platform/agent-vault/proxies#traffic-policy). **Give every agent an identity and an owner.** Sessions are created by a user or a machine identity, so every agent run is attributable to someone. For agents that run unattended, create a machine identity with Universal Auth, add it to Agent Vault, and grant it the bundles it needs; it then opens its own sessions with `--client-id` and `--client-secret`. Users, groups, and machine identities share two roles: **Admin** (manages bundles, services, proxies, grants, and reads audit logs) and **Member** (creates and revokes their own sessions on bundles granted to them). [Access control](https://infisical.com/docs/documentation/platform/agent-vault/access-control): roles, grants, and groups. **Make access expire.** Every session expires on a schedule you set (`--ttl 30m`, `8h`, `7d`, or `never`), and the CLI revokes the session when the agent exits unless you pass `--keep-session`. Revoking a session, removing a grant, or deleting a bundle takes effect on running agents within one poll interval, 60 seconds by default and configurable from 10 to 300, with no agent restart. [Sessions](https://infisical.com/docs/documentation/platform/agent-vault/sessions): duration, revocation, and how access changes apply mid-run. **See what every agent did.** Session logs record every request the proxy handles: time, proxy, method, host, path, upstream status, the matching service, and the outcome (`brokered`, `passthrough`, `blocked`, or `error`). Request and response bodies, headers, and query strings are not recorded. The proxy encrypts the records before they leave your network and stores them in an Amazon S3 bucket you own. Admins and the session's creator can search them live in the dashboard, or pull and decrypt them through the API. The Sessions page keeps expired and revoked sessions, and creating or revoking a session writes an audit event that can stream to your SIEM. [Session logs](https://infisical.com/docs/documentation/platform/agent-vault/session-logs): setup, record format, and API export. **Contain a stolen session token.** A session token only works through your proxy, only for the hosts, methods, and paths in its bundle, and only until it expires or is revoked. Revoking a proxy cuts off every agent using it at once. [Why use Agent Vault?](https://infisical.com/docs/documentation/platform/agent-vault/why-agent-vault): the prompt-injection threat model with a worked example. **Reuse values across services.** Variables store a value once per access bundle (up to 100) and reference it as `{{GITHUB_TOKEN}}` in any service's token, basic auth, custom header, or substitution. Changing a variable reaches running agents within one poll interval. [Variables](https://infisical.com/docs/documentation/platform/agent-vault/variables). ## Getting started 1. Create an access bundle and add a service from a template. 2. Create a proxy and run the enrollment command on the host where agent traffic leaves your network. 3. Create a session for the bundle and launch the agent with the command it gives you. [Quickstart](https://infisical.com/docs/documentation/platform/agent-vault/quickstart): one agent making an authenticated API call in a few minutes, with a picker for each harness and service. ## Where it works Complete as of this page's last update. The docs are authoritative if something is missing. **Agent harnesses with step-by-step guides:** | Harness | Guide | |---|---| | Claude Code | [Agent Vault with Claude Code](https://infisical.com/docs/documentation/platform/agent-vault/guides/claude-code) | | Codex | [Agent Vault with Codex](https://infisical.com/docs/documentation/platform/agent-vault/guides/codex) | | OpenCode | [Agent Vault with OpenCode](https://infisical.com/docs/documentation/platform/agent-vault/guides/opencode) | | Hermes Agent | [Agent Vault with Hermes Agent](https://infisical.com/docs/documentation/platform/agent-vault/guides/hermes), and the [Hermes gateway](https://infisical.com/docs/documentation/platform/agent-vault/guides/hermes-gateway) for messaging platforms | | OpenClaw | [Agent Vault with OpenClaw](https://infisical.com/docs/documentation/platform/agent-vault/guides/openclaw), and the [OpenClaw gateway](https://infisical.com/docs/documentation/platform/agent-vault/guides/openclaw-gateway) for messaging platforms | **Anything else that honors `HTTPS_PROXY`** works without code changes, including custom harnesses, `curl`, `git`, `gh`, Python `requests`, `axios`, `node-fetch`, `got`, and most SDKs. Node.js's built-in `fetch` needs `--use-env-proxy` or `NODE_USE_ENV_PROXY=1` (Node 24 or later). The CLI also sets `SSL_CERT_FILE`, `NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, `GIT_SSL_CAINFO`, and `DENO_CERT` so the agent trusts the proxy's certificate. **Service templates** (any other HTTP API works as a custom service): | Category | Templates | |---|---| | **Model providers** | OpenAI, Anthropic, Google Gemini, Mistral AI, Cohere, Groq, Perplexity, OpenRouter, Together AI, DeepSeek, xAI (Grok), Fireworks AI | | **Code and deploys** | GitHub, GitLab, GitHub Packages, npm, Vercel, Cloudflare, Supabase | | **Messaging and email** | Slack, Discord, Twilio, SendGrid, Resend, Postmark | | **Work tools** | Linear, Notion, Jira, Google Workspace | | **Observability** | Datadog, Sentry, PagerDuty | | **Commerce** | Stripe, Shopify | **Hosts** can be exact (`api.github.com`), lists, one-label wildcards (`*.atlassian.net`), non-standard ports, or plain HTTP hosts on a network you trust. ## Limits worth knowing - **It is not a sandbox.** `infisical agent-vault run` routes traffic and sets up certificate trust, but does not restrict the agent's filesystem or processes. Pair it with a sandbox if the agent should not reach other local resources. - **Run the proxy on a different machine from the agent** where possible. The proxy's state directory holds its access token and CA private key, and session tokens travel to the proxy unencrypted, so keep the proxy on a private network only your agents can reach. - **Substitution skips bodies over 10 MB or compressed with `Content-Encoding`.** Those requests are forwarded unchanged. - **If the proxy can't reach Infisical,** it keeps using the last session data for five poll intervals, then refuses affected requests with a `502` rather than sending them without credentials. ## FAQ **Does Agent Vault work with Claude Code, Codex, or my own agent?** Yes. Guides exist for Claude Code, Codex, OpenCode, Hermes Agent, and OpenClaw, and any harness whose HTTP clients honor `HTTPS_PROXY` works without code changes. **What happens if the agent is prompt injected?** There is no credential in the agent's environment to exfiltrate. A hijacked agent can only use the services in its session's access bundle, within their method and path rules, until the session ends, and session logs show every request it made. **Can each agent have its own identity?** Yes. Create a machine identity, add it to Agent Vault under Access Control, and grant it the access bundles it needs. Its sessions and their logs then belong to it rather than to whoever started it. **How fast does revocation take effect?** Within one poll interval, 60 seconds by default. **Can I self-host it?** Yes. Agent Vault runs on Infisical Cloud (US and EU) and on self-hosted Infisical. The proxy always runs on your infrastructure. **Is this the open-source `Infisical/agent-vault` repository?** No. `github.com/Infisical/agent-vault` is the open-source research preview Infisical released in April 2026, with its own `agent-vault` CLI. The product on this page is part of the Infisical platform and uses the Infisical CLI (`infisical agent-vault`). **Is this the same as `infisical secrets agent-proxy`?** No. That is an earlier agent proxy feature inside Secrets Management. Agent Vault is a separate product with its own access bundles, sessions, proxies, and session logs. ## Pricing Agent Vault is priced separately from Secrets Management. [pricing.md](https://infisical.com/pricing.md): exact plan contents. ## Docs - [Agent Vault overview](https://infisical.com/docs/documentation/platform/agent-vault/overview) - [How it works](https://infisical.com/docs/documentation/platform/agent-vault/how-it-works): the four primitives and a request walked end to end - [Proxies](https://infisical.com/docs/documentation/platform/agent-vault/proxies): deployment, traffic policy, certificate trust and pinning, re-enrollment - [CLI reference](https://infisical.com/docs/cli/reference#agent-vault): every flag of `infisical agent-vault proxy` and `infisical agent-vault run` - [API reference](https://infisical.com/docs/api-reference/endpoints/agent-vault-sessions/create): sessions, access bundles, services, variables, proxies, members, and session logs - [ai-agents.md](https://infisical.com/ai-agents.md): everything Infisical does for AI agents, including when to use PAM agentic access instead