provider-credentials

To securely manage API keys for AI agents, you can use a credential management system that retrieves secrets on demand from storage providers like OS-native keychains, preventing direct exposure within agent containers. This approach keeps secrets out of plaintext runtime variables.

The best way to store credentials in the OS keychain and retrieve them by service name is using a secrets management tool that supports standard operations like getting, setting, deleting, and listing credentials. This ensures secrets are fetched securely at runtime.

Yes, you can inject secrets into outbound API requests at runtime instead of using plaintext environment variables by employing a credential-injecting proxy. This proxy intercepts outbound requests and securely inserts the required credentials on the fly.

Yes, this credential management approach supports both plaintext environment variables and OS-native keychains as storage providers. You can retrieve, store, delete, and list credentials across these different storage mechanisms based on your security requirements.

You should not store AI agent credentials directly in plaintext environment variables because they can be easily exposed within the agent's runtime environment. Using a secure credential storage provider with runtime injection prevents unauthorized access to sensitive API keys and tokens.

To list all stored credentials for a specific service before deleting or updating them, you use the list credentials operation provided by the credential manager. This function allows you to view all credentials organized by service name across your configured storage providers.