What problem does it solve? Sandboxed agents often need to call third-party APIs with real credentials, but placing a key in the sandbox's environment variables exposes it to any code running inside. This Skill stores credentials in a write-only vault and substitutes them into outbound requests at the egress sidecar, so the sandbox only ever holds a decoy value. ## Core Features & Use Cases - Write-only vault storage: Store secrets through the E2B /secrets surface where values can be listed and overwritten but never read back. - Outbound header injection: Reference secrets by name in network rules on sandbox creation; the sidecar swaps the decoy for the real credential on matching hosts, while plaintext values in rules are refused with a 400. - Silent-failure diagnostics: Troubleshoot missing substitution by checking gateway enablement, exact host matching, port 80/443 restriction, and per-user vault identity. - Use Case: An agent inside a sandbox calls the OpenAI API using OPENAI_API_KEY; the code runs unmodified while the real key never exists inside the sandbox. ## Quick Start Store my API token in the vault and create a sandbox with an injection rule so its outbound requests to the API host carry the real credential without exposing it inside the sandbox.
