Secret management for AI agents
An AI agent needs credentials to be useful and is unusually good at leaking them. It writes logs, it builds prompts from context, it commits files, and it may pass its own state to another model.
So the question is not “how do I store the agent's keys?” but “how do I stop the agent ever holding the key at all?”
Why agents leak secrets differently from applications
Everything can become a prompt
An agent assembles context from files, errors and tool output. A key that reaches any of those can end up in a request to a model provider.
Logs are verbose by necessity
Debugging autonomous behaviour requires detail, and detail is exactly how secrets escape into log aggregators.
Agents commit code
An agent writing files can write a key into one, and a public repository turns a private mistake into a public one within minutes.
Blast radius is wide
A leaked key from a long-running agent may have been usable for weeks before anyone notices, because there was no human in the loop to notice.
The rules that actually help
Do not give the agent the key
The strongest control by far. If the agent never holds the secret, it cannot leak it. Give it a capability instead — a signature, a scoped token, a proxied call.
Sign, do not share
For anything cryptographic, send the payload to the key rather than the key to the agent. The secret stays in one place and the agent gets only the result.
Scope per task
A credential should do one job. Broad credentials turn one compromise into total compromise.
Rotate on a schedule and on suspicion
Rotation limits the useful life of a leak you have not detected yet. It is the control that works when the others have already failed.
Record every sensitive action
You cannot investigate what you did not record. Who asked, for what, when, and was it allowed.
Never put secrets in the client bundle
Anything prefixed for public exposure in a frontend framework is public. This is worth enforcing at build time rather than trusting to review.
What Vault is
Vault stores and signs the keys AI agents use. Keys stay encrypted at rest; an agent receives scoped access or a signature, never the raw secret, and every sensitive action is recorded.
The same principle runs through Empyre itself. Each generated company has an encrypted environment vault: values are encrypted at rest, agents see key names but never values, and the platform-managed keys cannot be read or overwritten even by the founder's own tooling — because silently replacing an auth key would break every account in that product.
Frequently asked questions
How do AI agents securely store API keys?
The safest answer is that they do not store them. Keys live in a dedicated secret service; the agent receives a short-lived scoped token, a signature, or a proxied call. If an agent must hold a key, it should be narrowly scoped, short-lived, rotated on a schedule, and never written to logs or prompts.
Is an environment variable good enough?
For a server process, environment variables are a reasonable baseline. For an agent they are weaker than they look, because the agent's own error handling and context assembly can surface the process environment into a prompt or a log line. Prefer a service that hands out capabilities rather than values.
What is the difference between Vault, Doppler and Infisical?
Doppler and Infisical are excellent secret managers built primarily for applications and CI — syncing configuration to environments. They are mature and, if that is your problem, likely the better fit. Vault is narrower and aimed at agents: signing on behalf of a key so the requester never receives it, and recording every access. Different problems, and it is reasonable to run both.
How do I know if a key has leaked?
You need an access record and an alert on unusual patterns — an agent requesting a credential it has never used, or at a rate it has never used. Without recorded access you are relying on the provider noticing before you do.
Vault — key storage and signing for AI agents
Keys stay encrypted. Agents get access or a signature, never the raw secret, and every sensitive action is recorded.