> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Vault with Codex

> Launch Codex with Agent Vault so it can call HTTP APIs and MCP servers without having access to their credentials.

I want

to access

This guide walks you through using Agent Vault to launch an agent that calls HTTP APIs and MCP servers without having access to their credentials.

> [!TIP]
>
> This guide runs Hermes in your terminal. If you chat with Hermes through Slack, Telegram, or another messaging platform, follow [Agent Vault with the Hermes gateway](https://infisical.com/docs/documentation/platform/agent-vault/guides/hermes-gateway.md) instead.

> [!TIP]
>
> This guide runs OpenClaw in your terminal. If you chat with OpenClaw through Slack, Telegram, or another messaging platform, follow [Agent Vault with the OpenClaw gateway](https://infisical.com/docs/documentation/platform/agent-vault/guides/openclaw-gateway.md) instead.

## Prerequisites

<ul>
  <li>An Infisical organization where you're an [Agent Vault admin](https://infisical.com/docs/documentation/platform/agent-vault/access-control.md#product-membership)</li>
  <li>An [access bundle](https://infisical.com/docs/documentation/platform/agent-vault/access-bundles.md) with a service for each API the agent calls (see the [quickstart](https://infisical.com/docs/documentation/platform/agent-vault/quickstart.md))</li>
  <li>The [Infisical CLI](https://infisical.com/docs/cli/install.md) installed on the host that will run the Agent Vault proxy and on the host that will run the agent</li>

  <li>[Claude Code](https://docs.claude.com/en/docs/claude-code/overview) installed on the host that will run the agent</li>

  <li>[Codex CLI](https://github.com/openai/codex) installed on the host that will run the agent</li>

  <li>[Hermes Agent](https://hermes-agent.nousresearch.com/docs/getting-started/quickstart) installed on the host that will run the agent, with a model provider set up and working</li>

  <li>[OpenCode](https://opencode.ai/) installed on the host that will run the agent</li>

  <li>[OpenClaw](https://docs.openclaw.ai/start/getting-started) installed on the host that will run the agent, with a model provider set up and working with an API key</li>
</ul>

> [!NOTE]
>
> We recommend running the proxy on a different machine than the agent. If they run on the same machine, the agent could read the proxy token and the private key of the proxy's certificate authority.
>
> We also recommend keeping both machines on the same private network. This is because every request the agent makes goes through the proxy, and a round trip between networks adds latency to every request.

## Step 1: Set up in Infisical

### Create a proxy

First, create a [proxy](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md) to intercept API calls from your agent.

**Step 1**

Go to **Proxies** and select **Create Proxy**.

**Step 2**

Give the proxy a **Name**, then select **Create**. The **Proxy Token** dialog shows the proxy token once, with a command to start the proxy. Copy the command from the **CLI** tab for the next step.

**Step 3**

On the host that will act as the proxy, run the command from the previous step.

```bash theme={"dark"}
INFISICAL_AGENT_VAULT_PROXY_TOKEN=<proxy-token> \
infisical agent-vault proxy \
  --domain <your-instance-url>
```

The proxy starts listening on port `17323`. Leave it running and note this host's address. You'll need the address when you launch your agent.

> [!NOTE]
>
> This runs the proxy in your current terminal, so the proxy stops when the terminal closes. For a persistent setup, use the **Docker** command or the **Kubernetes** manifest from the **Proxy Token** dialog, or [run the proxy with systemd](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md#create-a-proxy-and-start-it).
>
> Check out the [proxies documentation](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md) for more information.

### Create a session

Next, create a [session](https://infisical.com/docs/documentation/platform/agent-vault/sessions) with your access bundle attached.

**Step 1**

Go to **Sessions** and select **Create Session**.

**Step 2**

Pick the **Access Bundle** the agent should use, set a duration under **Expires**, then select **Create Session**.

![The Create Session dialog with code-review picked and a seven day expiry](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/session-create.png)

**Step 3**

This creates the session and gives you a command to run your agent with it. Copy the command for the next step.

![The Session Created dialog showing the infisical agent-vault run command with the session token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/session-created.png)

## Step 2: Launch your agent

On the host where the agent runs, paste the command you copied in the previous step. Replace `<proxy-host>` with your host's actual domain or IP address, and `<agent-command>` with your agent's own command.

For example, with Claude:

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- claude
```

For Claude Code, the command is `claude`:

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- claude
```

For Codex, the command is `codex`:

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- codex
```

> [!NOTE]
>
> Codex first tries to reach the OpenAI API over a WebSocket, which [fails through the proxy](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md#supported-connections). You may see a few connection errors before Codex switches to HTTPS and responds.

Hermes reads its API keys from `~/.hermes/.env`, and it won't start without them. If the service you added holds one of those keys, such as your model provider's key, replace the key's value in that file with a placeholder, such as `agent-vault-openai`. The proxy attaches the real key, so Hermes only needs a value it accepts. If the service uses a [substitution](https://infisical.com/docs/documentation/platform/agent-vault/http-apis.md#substitutions), use the exact value you entered in **Replace** instead.

> [!WARNING]
>
> Hermes treats some values as an unset key, including `dummy`, `placeholder`, `changeme`, `none`, and values made only of `x` characters, such as `sk-xxxx`. If you use one of these values, Hermes reports the key as missing instead of sending it to the proxy.

Then start Hermes. For Hermes Agent, the command is `hermes --tui`:

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- hermes --tui
```

For OpenCode, the command is `opencode`:

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- opencode
```

If the service you added holds your model provider's key, OpenClaw needs a placeholder in its place. Onboarding saves the key in OpenClaw's credential store. Run `openclaw models auth list` to find the saved profile, then remove it with `openclaw models auth logout <profile-id>`.

Then create `~/.openclaw/.env`, or add to it if it already exists, with a placeholder for the key, such as `OPENAI_API_KEY=agent-vault-openai`. The proxy attaches the real key, so OpenClaw only needs a value to send. If the service uses a [substitution](https://infisical.com/docs/documentation/platform/agent-vault/http-apis.md#substitutions), use the exact value you entered in **Replace** instead.

Then start OpenClaw's terminal UI in local mode, so it runs without a separate Gateway. For OpenClaw, the command is `openclaw tui --local`:

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- openclaw tui --local
```

> [!TIP]
>
> Instead of passing `--session-token` and `--proxy`, you can set the [`INFISICAL_AGENT_VAULT_SESSION_TOKEN` and `INFISICAL_AGENT_VAULT_PROXY_ADDRESS` environment variables](https://infisical.com/docs/cli/reference#agent-vault-run).

The CLI adds the proxy's certificate authority to the agent process' trusted CAs and starts the agent with its HTTP traffic routed through the proxy. Any calls to services in your access bundle leave the proxy with the real credential attached, while calls to any other host go out normally.

> [!NOTE]
>
> On macOS, you'll need to enter your user password when running your agent for the first time. This is because macOS needs your approval to add the proxy's certificate to your keychain.

## Step 3: Verify it works

To confirm the proxy is attaching credentials, make a test call to a service you configured. Pick an authenticated endpoint on that service (for example, one that returns your account), and make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Anthropic. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Cloudflare. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Cohere. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Datadog. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to DeepSeek. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Discord. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Fireworks AI. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to GitHub. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to GitHub Packages. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to GitLab. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Google Gemini. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Google Workspace. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Groq. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Jira. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Linear. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Mistral AI. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Notion. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to npm. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to OpenAI. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to OpenRouter. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to PagerDuty. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Perplexity. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Postmark. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Resend. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to SendGrid. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Sentry. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Shopify. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Slack. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Stripe. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Supabase. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Together AI. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Twilio. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to Vercel. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to xAI. Make the call one of two ways:

To confirm the proxy is attaching credentials, make a call to the API you configured. Make the call one of two ways:

**With your agent**

In your running agent's session, ask it to make the call. For example:

> Run `curl -sS <endpoint-url>` and show me the output.

The API should respond successfully. The agent doesn't need any real API credentials because the proxy attaches the credential as the request passes through. Run the same command outside the agent, and it fails with an authentication error.

> Run `curl -sS https://api.github.com/user` and show me the output.

GitHub returns your account. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://slack.com/api/auth.test` and show me the output.

Slack returns your workspace and user IDs. Run the same request outside the agent and it returns `not_authed`.

> Run `curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01"` and show me the output.

Anthropic returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.openai.com/v1/models` and show me the output.

OpenAI returns the list of available models. Run the same request outside the agent and it fails with a 401.

Ask the agent to hit an authenticated endpoint. The proxy attaches the credential as the request passes through, so the agent needs no real token. Run the same request outside the agent and it should fail with an authentication error.

> Run `curl -sS https://generativelanguage.googleapis.com/v1beta/models` and show me the output.

Google Gemini returns the list of available models. Run the same request outside the agent and it fails with a 403.

> Run `curl -sS https://api.mistral.ai/v1/models` and show me the output.

Mistral AI returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.cohere.com/v1/models` and show me the output.

Cohere returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.groq.com/openai/v1/models` and show me the output.

Groq returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.deepseek.com/v1/models` and show me the output.

DeepSeek returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://openrouter.ai/api/v1/credits` and show me the output.

OpenRouter returns your credit balance. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.together.xyz/v1/models` and show me the output.

Together AI returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.x.ai/v1/models` and show me the output.

xAI returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.fireworks.ai/inference/v1/models` and show me the output.

Fireworks AI returns the list of available models. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.perplexity.ai/async/chat/completions` and show me the output.

Perplexity returns the list of your async requests. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify` and show me the output.

Cloudflare returns your token's status. Run the same request outside the agent and it fails with a 400.

> Run `curl -sS https://api.datadoghq.com/api/v1/validate` and show me the output.

Datadog confirms your API key is valid. Run the same request outside the agent and it fails with a 403.

> Run `curl -sS https://discord.com/api/v10/users/@me` and show me the output.

Discord returns your bot user. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://gitlab.com/api/v4/user` and show me the output.

GitLab returns your user profile. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://npm.pkg.github.com/-/whoami` and show me the output.

GitHub Packages returns your npm username, confirming the token is valid. Run the same request outside the agent and it fails with a 403.

> Run `curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28"` and show me the output.

Notion returns your bot user. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://registry.npmjs.org/-/whoami` and show me the output.

npm returns your username. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.pagerduty.com/users/me` and show me the output.

PagerDuty returns your user profile. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.postmarkapp.com/server` and show me the output.

Postmark returns your server's info. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.resend.com/api-keys` and show me the output.

Resend returns your API keys. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.sendgrid.com/v3/user/account` and show me the output.

SendGrid returns your account info. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://sentry.io/api/0/organizations/` and show me the output.

Sentry returns the organizations your token can access. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.stripe.com/v1/account` and show me the output.

Stripe returns your account. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS https://api.vercel.com/v2/user` and show me the output.

Vercel returns your user profile. Run the same request outside the agent and it fails with a 403.

Ask the agent to make a call to a Google Workspace API. For example:

```bash Gmail theme={"dark"}
curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile
```

```bash Google Calendar theme={"dark"}
curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList
```

```bash Google Drive theme={"dark"}
curl -sS https://www.googleapis.com/drive/v3/about?fields=user
```

Google returns your Gmail profile, calendars, or Drive info depending on the endpoint. Run the same request outside the agent and it fails with a 401.

> [!NOTE]
>
> Replace `<your-tenant>` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`).

> Run `curl -sS https://<your-tenant>.atlassian.net/rest/api/3/myself` and show me the output.

Jira returns your user profile. Run the same request outside the agent and it fails with a 401.

> [!NOTE]
>
> Replace `<your-account-sid>` with your Twilio Account SID from the [Twilio console](https://console.twilio.com/).

> Run `curl -sS https://api.twilio.com/2010-04-01/Accounts/<your-account-sid>.json` and show me the output.

Twilio returns your account. Run the same request outside the agent and it fails with a 401.

> [!NOTE]
>
> Replace `<your-store>` with your Shopify store subdomain (for example, `mystore` from `mystore.myshopify.com`).

> Run `curl -sS https://<your-store>.myshopify.com/admin/api/2024-01/shop.json` and show me the output.

Shopify returns your shop info. Run the same request outside the agent and it fails with a 401.

> [!NOTE]
>
> Replace `<your-project>` with your Supabase project ref from the [project settings](https://supabase.com/dashboard).

> Run `curl -sS https://<your-project>.supabase.co/rest/v1/` and show me the output.

Supabase returns the OpenAPI schema for your project. Run the same request outside the agent and it fails with a 401.

> Run `curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}'` and show me the output.

Linear returns your user info. Run the same request outside the agent and it fails with a 401.

**With `curl`**

Any HTTP client works the same way. Run it through the proxy in place of your agent's command:

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS <endpoint-url>
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.github.com/user
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://slack.com/api/auth.test
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.anthropic.com/v1/models -H "anthropic-version: 2023-06-01"
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.openai.com/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://generativelanguage.googleapis.com/v1beta/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.mistral.ai/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.cohere.com/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.groq.com/openai/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.deepseek.com/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://openrouter.ai/api/v1/credits
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.together.xyz/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.x.ai/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.fireworks.ai/inference/v1/models
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.perplexity.ai/async/chat/completions
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.cloudflare.com/client/v4/user/tokens/verify
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.datadoghq.com/api/v1/validate
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://discord.com/api/v10/users/@me
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://gitlab.com/api/v4/user
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://npm.pkg.github.com/-/whoami
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.notion.com/v1/users/me -H "Notion-Version: 2022-06-28"
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://registry.npmjs.org/-/whoami
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.pagerduty.com/users/me
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.postmarkapp.com/server
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.resend.com/api-keys
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.sendgrid.com/v3/user/account
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://sentry.io/api/0/organizations/
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.stripe.com/v1/account
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.vercel.com/v2/user
```

```bash Gmail theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://gmail.googleapis.com/gmail/v1/users/me/profile
```

```bash Google Calendar theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://www.googleapis.com/calendar/v3/users/me/calendarList
```

```bash Google Drive theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://www.googleapis.com/drive/v3/about?fields=user
```

> [!NOTE]
>
> Replace `<your-tenant>` with your Atlassian subdomain (for example, `mycompany` from `mycompany.atlassian.net`).

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://<your-tenant>.atlassian.net/rest/api/3/myself
```

> [!NOTE]
>
> Replace `<your-account-sid>` with your Twilio Account SID.

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://api.twilio.com/2010-04-01/Accounts/<your-account-sid>.json
```

> [!NOTE]
>
> Replace `<your-store>` with your Shopify store subdomain.

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://<your-store>.myshopify.com/admin/api/2024-01/shop.json
```

> [!NOTE]
>
> Replace `<your-project>` with your Supabase project ref.

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS https://<your-project>.supabase.co/rest/v1/
```

```bash theme={"dark"}
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- curl -sS -X POST https://api.linear.app/graphql -H "Content-Type: application/json" -d '{"query":"{ viewer { id name } }"}'
```

The proxy logs the request as `brokered`.

> [!TIP]
>
> Your agent now has a session where it can make authenticated calls to an API without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call GitHub without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Slack without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call the Anthropic API without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call the OpenAI API without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Google Gemini without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Mistral AI without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Cohere without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Groq without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Perplexity without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call OpenRouter without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Together AI without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call DeepSeek without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call xAI without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Fireworks AI without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Stripe without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Twilio without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call SendGrid without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Resend without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Discord without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Postmark without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call GitLab without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Vercel without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Cloudflare without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Supabase without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call npm without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call GitHub Packages without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Datadog without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Sentry without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call PagerDuty without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Linear without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Notion without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Jira without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Google Workspace without ever seeing a real token.

> [!TIP]
>
> Your agent now has a session where it can call Shopify without ever seeing a real token.

## Troubleshooting

> **Authentication error from the upstream API**
>
> The credential wasn't applied. Open your access bundle and confirm a service covers the host you called. If one does, the stored token is likely wrong.

> **407 from the proxy**
>
> The session token was missing from the request. Confirm you passed `--session-token`, or that the token appears as the userinfo in your `HTTPS_PROXY` URL (like `http://x-agent-vault:<session-token>@<proxy-address>`).

> **403 from the proxy**
>
> This could be for a few reasons:
>
> * The session was revoked or has expired (check the **Sessions** page in Infisical, and create a new one if needed)
> * Under the proxy's [strict traffic policy](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md#traffic-policy), no service in the bundle covers the host you called (add a service that does, or use a pass-through service)
> * The service covers the host, but doesn't allow the request's method or path (check the service's [methods and paths](https://infisical.com/docs/documentation/platform/agent-vault/http-apis.md#methods-and-paths))

## Next steps

> **[Create sessions with the CLI](https://infisical.com/docs/documentation/platform/agent-vault/sessions-cli.md)**
>
> Run your agent from cron, a container, or CI, with a new session for each run.

> **[Create sessions with the API](https://infisical.com/docs/documentation/platform/agent-vault/sessions-api.md)**
>
> Create sessions from code every time you start your agent.

> **[Skills](https://infisical.com/docs/documentation/platform/agent-vault/skills.md)**
>
> Give your agent your team's instructions each time it starts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.