{"docsConfig":{"theme":"aspen","$schema":"https://mintlify.com/docs.json","name":"Infisical","colors":{"primary":"#26272b","light":"#dbf530","dark":"#A1B659"},"logo":{"light":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/light.svg","dark":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/dark.svg","href":"/"},"favicon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico","api":{"openapi":"https://app.infisical.com/api/docs/json","mdx":{"server":["https://app.infisical.com"]}},"appearance":{"default":"light"},"background":{"color":{"light":"#ffffff","dark":"#08090b"}},"navbar":{"links":[{"href":"https://app.infisical.com/login","label":"Log In"}],"primary":{"type":"button","label":"Start for Free","href":"https://app.infisical.com/signup"}},"footer":{"socials":{"x":"https://www.twitter.com/infisical","linkedin":"https://www.linkedin.com/company/infisical","github":"https://github.com/Infisical/infisical-cli","website":"https://community.infisical.com"},"links":[{"header":"PRODUCT","items":[{"label":"Secrets Management","href":"https://infisical.com/platform/secrets-management"},{"label":"Certificate Management","href":"https://infisical.com/platform/certificate-management"},{"label":"Privileged Access Management (PAM)","href":"https://infisical.com/platform/pam"},{"label":"Agent Vault","href":"https://infisical.com/platform/agent-vault"},{"label":"Key Management Service (KMS)","href":"https://infisical.com/docs/documentation/platform/kms/overview"},{"label":"Secret Scanning","href":"https://infisical.com/radar"},{"label":"Share Secrets","href":"https://app.infisical.com/share-secret"},{"label":"Pricing","href":"https://infisical.com/pricing"},{"label":"Security","href":"https://infisical.com/docs/internals/security"},{"label":"Blog","href":"https://infisical.com/blog"},{"label":"Infisical vs Vault","href":"https://infisical.com/infisical-vs-hashicorp-vault"},{"label":"Community","href":"https://community.infisical.com/"}]},{"header":"USE CASES","items":[{"label":"Infisical Agent","href":"https://infisical.com/docs/documentation/getting-started/introduction"},{"label":"Infisical Proxy","href":"https://infisical.com/docs/integrations/platforms/infisical-proxy"},{"label":"Kubernetes","href":"https://infisical.com/docs/integrations/platforms/kubernetes"},{"label":"Dynamic Secrets","href":"https://infisical.com/docs/documentation/platform/dynamic-secrets/overview"},{"label":"Terraform","href":"https://registry.terraform.io/providers/Infisical/infisical/latest/docs"},{"label":"Ansible","href":"https://infisical.com/docs/integrations/platforms/ansible"},{"label":"Jenkins","href":"https://infisical.com/docs/integrations/cicd/jenkins"},{"label":"Docker","href":"https://infisical.com/docs/integrations/platforms/docker"},{"label":"AWS ECS","href":"https://infisical.com/docs/integrations/platforms/ecs-with-agent"},{"label":"GitLab","href":"https://infisical.com/docs/integrations/cicd/gitlab"},{"label":"GitHub","href":"https://infisical.com/docs/integrations/cicd/githubactions"},{"label":"SDK","href":"https://infisical.com/docs/sdks/overview"}]},{"header":"DEVELOPERS","items":[{"label":"Changelog","href":"https://github.com/Infisical/infisical/releases"},{"label":"Status","href":"https://status.infisical.com/"},{"label":"Feedback \u0026 Requests","href":"https://github.com/Infisical/infisical/issues"},{"label":"Trust of Center","href":"https://app.vanta.com/infisical.com/trust/hoop8cr78cuarxo9sztvs"},{"label":"Open Source Friends","href":"https://infisical.com/infisical-friends"},{"label":"How to contribute","href":"https://www.infisical.com/infisical-heroes"}]},{"header":"OTHERS","items":[{"label":"Customers","href":"https://infisical.com/customers/traba"},{"label":"Company Handbook","href":"https://infisical.com/wiki/handbook/overview"},{"label":"Careers","href":"https://infisical.com/careers"},{"label":"Terms of Service","href":"https://infisical.com/terms"},{"label":"Privacy Policy","href":"https://infisical.com/privacy"},{"label":"Subprocessors","href":"https://infisical.com/subprocessors"},{"label":"SLA","href":"https://infisical.com/sla"},{"label":"Support Email","href":"mailto:support@infisical.com"},{"label":"Sales","href":"mailto:sales@infisical.com"},{"label":"Support","href":"https://community.infisical.com"}]}]},"fonts":{"heading":{"family":"Alliance","weight":400,"source":"https://infisical.com/docs/fonts/AllianceNo2-Regular.woff2","format":"woff2"}},"icons":{"library":"lucide"},"styling":{"eyebrows":"breadcrumbs","codeblocks":"dark","latex":false},"integrations":{"posthog":{"apiKey":"phc_Q0xfB3LeOqo7ySk4DE6zLNwDzHFesKcmigknCy4fTdV","apiHost":"https://p.infisical.com"},"koala":{"publicApiKey":"pk_b50d7184e0e39ddd5cdb43cf6abeadd9b97d"},"gtm":{"tagId":"GTM-WL5C7MWT"}},"contextual":{"options":["assistant","copy","view","chatgpt","claude","mcp"],"display":"header"},"thumbnails":{"appearance":"light"},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"infisical","hasAudioNarration":false,"actualSubdomain":"infisical","customDomains":["infisical.com"],"gitSource":{"type":"github","owner":"infisical","repo":"infisical","deployBranch":"main","contentDirectory":"docs","mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6ae3ee0f21dcd4885450f2e7","collectionId":"25dc9405-8747-4b15-808a-852d355f64db","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ae3ee0f21dcd4885450f2e7"},"feedback":{"thumbs":true,"edits":true,"issues":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ae4002cca852ef32bf22af6","clientVersion":"0.0.4021","searchFilterCounts":[{"language":"default","tag":"Reference","count":1864},{"language":"default","tag":"API","count":1821},{"language":"default","tag":"Secrets Management","count":910},{"language":"default","tag":"App connections","count":653},{"language":"default","tag":"Shared","count":564},{"language":"default","tag":"Secret syncs","count":420},{"language":"default","tag":"Products","count":374},{"language":"default","tag":"Certificate Management","count":317},{"language":"default","tag":"Platform","count":247},{"language":"default","tag":"Secret rotations","count":213}]},"assistantConfig":{"enableAskAiButton":true,"enableAskAiSearchBar":false},"basePath":"/docs","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"selectively-prewarm","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instinct-self-updating-docs","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"style.css","href":"/docs/_mintlify/custom/infisical/3172a334a2a87deb/style.css"}],"page":{"pagePath":"documentation/platform/agent-vault/plan-your-setup","slug":"/documentation/platform/agent-vault/plan-your-setup","pageMetadata":{"title":"Plan your Agent Vault setup","sidebarTitle":"Plan your setup","description":"Get a recommended Agent Vault setup for what you're building.","mode":"frame","href":"/documentation/platform/agent-vault/plan-your-setup"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Get a recommended Agent Vault setup for what you’re building.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];const AgentVaultSetupBranch=({building,runs,agent,model,children})=>{const SELECTION_EVENT=`av-setup-selection-change`;const RULES={personal:{model:`user`,runs:[`computer`,`server`,`container`]},assistant:{model:`user`,runs:[`computer`,`server`,`container`]},scheduled:{model:`job`,runs:[`computer`,`server`,`container`,`ci`]},platform:{model:`orchestrator`,runs:[`server`,`container`,`ci`]}};const ALL_AGENTS=[`claude-code`,`codex`,`opencode`,`hermes`,`openclaw`,`custom`];const readSelection=()=>{const params=new URLSearchParams(window.location.search);const buildingId=Object.prototype.hasOwnProperty.call(RULES,params.get(`building`))?params.get(`building`):`personal`;const rule=RULES[buildingId];const runsId=params.get(`runs`);const agentId=params.get(`agent`);return{building:buildingId,model:rule.model,runs:rule.runs.includes(runsId)?runsId:null,agent:ALL_AGENTS.includes(agentId)?agentId:null}};const[selection,setSelection]=useState({building:`personal`,model:`user`,runs:null,agent:null});useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);const matches=(wanted,current)=>{if(wanted===undefined||wanted===null)return true;const list=String(wanted).split(`,`).map(entry=>entry.trim()).filter(Boolean);return list.length===0||list.includes(current??`none`)};if(!matches(building,selection.building)||!matches(model,selection.model)||!matches(runs,selection.runs)||!matches(agent,selection.agent)){return null}return _jsx(_Fragment,{children})};const AgentVaultSetupSummary=()=>{const BUILDS={personal:`coding agent for yourself`,assistant:`an always-on assistant`,scheduled:`a scheduled or unattended job`,platform:`a service that starts agents for tasks`};const RUNS={personal:[`computer`,`server`,`container`],assistant:[`computer`,`server`,`container`],scheduled:[`computer`,`server`,`container`,`ci`],platform:[`server`,`container`,`ci`]};const PLACES={computer:`on your computer`,server:`on a server or VM`,container:`in a container`,ci:`in a CI runner`};const AGENTS={\"claude-code\":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,hermes:`Hermes Agent`,openclaw:`OpenClaw`,custom:`your own agent`};const SELECTION_EVENT=`av-setup-selection-change`;const readSelection=()=>{const params=new URLSearchParams(window.location.search);const has=(object,key)=>Object.prototype.hasOwnProperty.call(object,key);const building=has(BUILDS,params.get(`building`))?params.get(`building`):`personal`;const runs=params.get(`runs`);const agent=params.get(`agent`);return{building,runs:RUNS[building].includes(runs)?runs:null,agent:has(AGENTS,agent)?agent:null}};const[selection,setSelection]=useState({building:`personal`,runs:null,agent:null});useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);let buildText=BUILDS[selection.building];if(selection.runs){buildText=selection.building===`platform`?`a service that starts agents ${PLACES[selection.runs]} for each task`:`${buildText} that runs ${PLACES[selection.runs]}`}const agentText=selection.agent?`, using ${AGENTS[selection.agent]}`:``;const missing=[];if(!selection.runs)missing.push(`where the agent runs`);if(!selection.agent)missing.push(`which agent you use`);return _jsxs(`p`,{children:[`You're building `,buildText,agentText,`.`,missing.length==0\u0026\u0026` Here's how the setup works:`,missing.length>0\u0026\u0026` Choose ${missing.join(` and `)} to fill in the rest of the setup.`]})};const AgentVaultSetupStep=({step,children})=>{const MODELS={personal:`user`,assistant:`user`,scheduled:`job`,platform:`orchestrator`};const CREATORS={user:`You`,job:`Infisical CLI`,orchestrator:`Orchestrator`};const SELECTION_EVENT=`av-setup-selection-change`;const readModel=()=>{const params=new URLSearchParams(window.location.search);const building=params.get(`building`);return Object.prototype.hasOwnProperty.call(MODELS,building)?MODELS[building]:`user`};const[model,setModel]=useState(`user`);useEffect(()=>{const sync=()=>setModel(readModel());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);const creator=CREATORS[model];const STEPS={before:{},create:{number:1,title:{user:`You create a session`,job:`The CLI logs in and creates a session`,orchestrator:`The orchestrator creates a session for the task`}[model],route:`${creator} → Infisical`},token:{number:2,title:`Infisical returns a session token`,route:`Infisical → ${creator}`},start:{number:3,title:{user:`You start the agent with the token`,job:`The CLI starts the agent with the token`,orchestrator:`The orchestrator starts an agent with the token`}[model],route:`${creator} → Agent`},request:{number:4,title:`The agent sends an API request`,route:`Agent → API (intercepted by proxy)`},fetch:{number:5,title:`The proxy gets the session's credentials`,route:`Proxy → Infisical`},forward:{number:6,title:`The proxy sends the request with the real credential`,route:`Proxy → API`},revoke:{number:7,title:model===`orchestrator`?`The orchestrator revokes the session when the task ends`:`The CLI revokes the session when the agent exits`,route:`${creator} → Infisical`}};const current=STEPS[step];if(!current||step===`revoke`\u0026\u0026model===`user`)return null;return _jsxs(`section`,{className:`ifx-avsp__walk-step`,\"data-avsp-focus\":`step-${step}`,children:[_jsxs(`div`,{className:`ifx-avsp__walk-head not-prose`,children:[current.number?_jsx(`span`,{className:`ifx-avsp__walk-num`,children:current.number}):null,_jsxs(`div`,{children:[_jsx(`h3`,{className:`ifx-avsp__walk-title`,children:current.title}),current.route?_jsx(`p`,{className:`ifx-avsp__walk-route`,children:current.route}):null]})]}),_jsx(`div`,{className:`ifx-avsp__walk-body`,children})]})};const AgentVaultSetupDiagram=({inline,reveal})=>{const _components={a:`a`,..._provideComponents()};const RULES={personal:{model:`user`,runs:[`computer`,`server`,`container`]},assistant:{model:`user`,runs:[`computer`,`server`,`container`]},scheduled:{model:`job`,runs:[`computer`,`server`,`container`,`ci`]},platform:{model:`orchestrator`,runs:[`server`,`container`,`ci`]}};const HOSTS={computer:`Your computer`,server:`Server or VM`,container:`Container`,ci:`CI runner`};const FOCUS={building:{lanes:[`infisical`,`creator`],messages:[`create`,`token`,`start`,`revoke`]},runs:{lanes:[`agent`,`proxy`],messages:[`start`,`request`]},agent:{lanes:[`agent`],messages:[`start`,`request`]},\"step-before\":{lanes:[`infisical`,`proxy`],messages:[]}};const SELECTION_EVENT=`av-setup-selection-change`;const AGENT_IDS=[`claude-code`,`codex`,`opencode`,`hermes`,`openclaw`,`custom`];const readSelection=()=>{const params=new URLSearchParams(window.location.search);const building=Object.prototype.hasOwnProperty.call(RULES,params.get(`building`))?params.get(`building`):`personal`;const runs=params.get(`runs`);const agent=params.get(`agent`);return{building,model:RULES[building].model,runs:RULES[building].runs.includes(runs)?runs:null,agent:AGENT_IDS.includes(agent)?agent:null}};const[selection,setSelection]=useState({building:`personal`,model:`user`,runs:null,agent:null});const[focus,setFocus]=useState(null);const buildRef=useRef(null);const GUIDES=`/documentation/platform/agent-vault`;let buildHref=`#build-your-setup`;if(selection.model===`user`){const guide={\"claude-code\":`guides/claude-code`,codex:`guides/codex`,opencode:`guides/opencode`,hermes:selection.building===`assistant`?`guides/hermes-gateway`:`guides/hermes`,openclaw:selection.building===`assistant`?`guides/openclaw-gateway`:`guides/openclaw`,custom:`guides/custom-agent`}[selection.agent];buildHref=`${GUIDES}/${guide??`quickstart`}`}useEffect(()=>{const link=buildRef.current;if(!link)return;const href=link.getAttribute(`href`)||``;const underDocs=window.location.pathname===`/docs`||window.location.pathname.startsWith(`/docs/`);if(underDocs\u0026\u0026href.startsWith(`/`)\u0026\u0026!href.startsWith(`/docs/`)){link.setAttribute(`href`,`/docs${href}`)}},[buildHref]);useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);let frame=0;const onScroll=()=>{cancelAnimationFrame(frame);frame=requestAnimationFrame(()=>{const line=window.innerHeight*.4;const sections=Array.from(document.querySelectorAll(`[data-avsp-focus]`));let current=null;sections.forEach(el=>{if(el.getBoundingClientRect().top\u003c=line)current=el});const last=sections[sections.length-1];if(current===last\u0026\u0026last.getBoundingClientRect().bottom\u003c=line)current=null;sections.forEach(el=>el.toggleAttribute(`data-avsp-active`,el===current));setFocus(current?current.getAttribute(`data-avsp-focus`):null)})};onScroll();window.addEventListener(`scroll`,onScroll,{passive:true});window.addEventListener(`resize`,onScroll);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync);window.removeEventListener(`scroll`,onScroll);window.removeEventListener(`resize`,onScroll);cancelAnimationFrame(frame)}},[]);const sharesHost=selection.model===`job`;const creator={user:{label:`You`,sub:`Infisical dashboard`},job:{label:`Infisical CLI`,sub:`Machine identity`},orchestrator:{label:`Orchestrator`,sub:`Machine identity`}}[selection.model];const lanes=[{id:`infisical`,label:`Infisical`,sub:`Cloud or self-hosted`},{id:`creator`,label:creator.label,sub:creator.sub},{id:`agent`,label:`Agent`,sub:selection.runs?HOSTS[selection.runs]:`Agent's host`},{id:`proxy`,label:`Proxy`,sub:`Its own host`},{id:`api`,label:`API`,sub:`Such as GitHub`}];const laneIndex=id=>lanes.findIndex(lane=>lane.id===id);const messages=[{id:`create`,from:`creator`,to:`infisical`,label:{user:`Create a session`,job:`Log in and create a session`,orchestrator:`Create a session for the task`}[selection.model]},{id:`token`,from:`infisical`,to:`creator`,label:`Session token`,reply:true},{id:`start`,from:`creator`,to:`agent`,label:selection.model===`orchestrator`?`Start an agent with the token`:`Start the agent with the token`},{id:`request`,from:`agent`,to:`proxy`,label:`API request`,note:`(e.g. api.github.com)`,aimedAt:`api`},{id:`fetch`,from:`proxy`,to:`infisical`,label:`Get the session's credentials`},{id:`forward`,from:`proxy`,to:`api`,label:`Request with the real credential`}];if(selection.model===`job`){messages.push({id:`revoke`,from:`creator`,to:`infisical`,label:`Revoke the session when the agent exits`})}if(selection.model===`orchestrator`){messages.push({id:`revoke`,from:`creator`,to:`infisical`,label:`Revoke the session when the task ends`})}const scrollToStep=id=>{const block=document.querySelector(`[data-avsp-focus=\"step-${id}\"]`);if(!block)return;const reduceMotion=window.matchMedia(`(prefers-reduced-motion: reduce)`).matches;block.scrollIntoView({behavior:reduceMotion?`auto`:`smooth`,block:`center`})};let highlight=null;if(focus){const stepMessage=messages.find(message=>`step-${message.id}`===focus);highlight=stepMessage?{lanes:[stepMessage.from,stepMessage.to],messages:[stepMessage.id]}:FOCUS[focus]??null}const stateClass=(base,active)=>{if(!highlight)return base;return active?`${base} ${base}--focus`:`${base} ${base}--dim`};let revealed=null;if(reveal){let stage=0;if(focus===null){stage=messages.length}else if(focus.startsWith(`step-`)\u0026\u0026focus!==`step-before`){stage=messages.findIndex(message=>`step-${message.id}`===focus)+1}const shown=messages.slice(0,stage);const current=focus\u0026\u0026focus.startsWith(`step-`)\u0026\u0026stage>0?shown[stage-1]:null;const shownLanes=new Set([`infisical`,`proxy`]);shown.forEach(message=>{shownLanes.add(message.from);shownLanes.add(message.to);if(message.aimedAt)shownLanes.add(message.aimedAt)});revealed={shown:new Set(shown.map(message=>message.id)),shownLanes,current}}const laneClass=id=>{if(!revealed)return stateClass(`ifx-avsp__lane`,highlight\u0026\u0026highlight.lanes.includes(id));if(!revealed.shownLanes.has(id))return`ifx-avsp__lane ifx-avsp__lane--hidden`;const focused=revealed.current?[revealed.current.from,revealed.current.to].includes(id):focus===`step-before`;return focused?`ifx-avsp__lane ifx-avsp__lane--focus`:`ifx-avsp__lane`};const messageClass=id=>{if(!revealed){return stateClass(`ifx-avsp__message`,highlight\u0026\u0026highlight.messages.includes(id))}if(!revealed.shown.has(id))return`ifx-avsp__message ifx-avsp__message--hidden`;if(!revealed.current)return`ifx-avsp__message`;return revealed.current.id===id?`ifx-avsp__message ifx-avsp__message--focus`:`ifx-avsp__message ifx-avsp__message--past`};const lifelineClass=id=>revealed\u0026\u0026!revealed.shownLanes.has(id)?`ifx-avsp__lifeline ifx-avsp__lifeline--hidden`:`ifx-avsp__lifeline`;const laneCount=lanes.length;const center=index=>`${(index+.5)/laneCount*100}%`;return _jsxs(`div`,{className:inline?`ifx-avsp__diagram-inline not-prose`:`not-prose`,children:[_jsx(`div`,{className:`ifx-avsp__panel-head`,children:_jsxs(_components.a,{ref:buildRef,href:buildHref,className:`ifx-btn ifx-btn--primary ifx-avsp__build-button`,children:[`Build`,_jsxs(`svg`,{width:`14`,height:`14`,viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,\"aria-hidden\":`true`,children:[_jsx(`path`,{d:`M5 12h14`}),_jsx(`path`,{d:`m12 5 7 7-7 7`})]})]})}),_jsx(`div`,{className:`ifx-avsp__diagram-scroll`,children:_jsxs(`div`,{className:`ifx-avsp__diagram`,role:`group`,\"aria-label\":`Setup diagram`,children:[_jsxs(`div`,{className:`ifx-avsp__lanes`,\"aria-hidden\":`true`,children:[sharesHost\u0026\u0026(!revealed||revealed.shownLanes.has(`creator`))\u0026\u0026_jsx(`div`,{className:`ifx-avsp__boundary`,children:_jsx(`span`,{className:`ifx-avsp__boundary-label`,children:`Same host`})}),lanes.map(lane=>_jsxs(`div`,{className:laneClass(lane.id),children:[_jsx(`span`,{className:`ifx-avsp__lane-label`,children:lane.label}),_jsx(`span`,{className:`ifx-avsp__lane-sub`,children:lane.sub})]},lane.id))]}),_jsxs(`div`,{className:`ifx-avsp__messages`,children:[lanes.map((lane,index)=>_jsx(`span`,{className:lifelineClass(lane.id),style:{left:center(index)},\"aria-hidden\":`true`},lane.id)),messages.map((message,index)=>{const from=laneIndex(message.from);const to=laneIndex(message.to);const start=Math.min(from,to);const span=Math.abs(to-from);const classes=[`ifx-avsp__arrow`];classes.push(to>from?`ifx-avsp__arrow--right`:`ifx-avsp__arrow--left`);if(message.reply)classes.push(`ifx-avsp__arrow--reply`);if(message.aimedAt)classes.push(`ifx-avsp__arrow--caught`);if(start===0)classes.push(`ifx-avsp__arrow--first-lane`);else if(start+span===laneCount-1)classes.push(`ifx-avsp__arrow--last-lane`);return _jsx(`div`,{className:`${messageClass(message.id)}${message.note?` ifx-avsp__message--noted`:``}`,children:_jsxs(`div`,{className:classes.join(` `),style:{left:center(start),width:`${span/laneCount*100}%`},children:[_jsxs(`span`,{className:`ifx-avsp__arrow-label`,children:[_jsx(`button`,{type:`button`,className:`ifx-avsp__arrow-num ifx-avsp__arrow-num--link`,\"aria-label\":`Go to step ${index+1}: ${message.label}`,onClick:()=>scrollToStep(message.id),children:index+1}),_jsx(`span`,{\"aria-hidden\":`true`,children:message.label})]}),message.note\u0026\u0026_jsx(`span`,{className:`ifx-avsp__arrow-note`,\"aria-hidden\":`true`,children:message.note}),message.aimedAt\u0026\u0026_jsxs(_Fragment,{children:[_jsx(`span`,{className:`ifx-avsp__arrow-catch`,\"aria-hidden\":`true`}),_jsx(`span`,{className:`ifx-avsp__arrow-aim`,style:{width:`calc(${(laneIndex(message.aimedAt)-to)/span*100}% - 4px)`},\"aria-hidden\":`true`})]})]})},message.id)})]})]})})]})};const AgentVaultSetupQuestions=()=>{const docsPath=typeof window===`undefined`?``:window.location.pathname;const docsBase=docsPath===`/docs`||docsPath.startsWith(`/docs/`)?`/docs`:``;const AGENT_IMG_BASE=`/images/agent-vault-agents`;const AGENT_IMAGES={\"claude-code\":{dark:`claude-code.svg`},codex:{light:`OpenAI.png`,dark:`OpenAIWhite.png`},hermes:{light:`hermes.png`,dark:`hermes.on-dark.png`},opencode:{light:`opencode.svg`,dark:`opencode.on-dark.svg`},openclaw:{dark:`openclaw.svg`}};const BUILDS=[{id:`personal`,label:`A coding agent for yourself`,example:`An agent that you work alongside, on your computer or a dev box.`,runs:[`computer`,`server`,`container`]},{id:`assistant`,label:`An always-on assistant`,example:`An agent that keeps running and answers messages, such as a chat bot.`,runs:[`computer`,`server`,`container`]},{id:`scheduled`,label:`A scheduled or unattended job`,example:`An agent that runs on a schedule or in CI, such as one that triages new issues.`,runs:[`computer`,`server`,`container`,`ci`]},{id:`platform`,label:`A service that starts agents for tasks`,example:`Your own service that starts a separate agent for each task it receives.`,runs:[`server`,`container`,`ci`]}];const RUNS=[{id:`computer`,label:`Your computer`,example:`Your laptop or desktop.`},{id:`server`,label:`A server or VM`,example:`Such as a dev box, a cloud VM, or a home server.`},{id:`container`,label:`A container`,example:`Such as a Docker container or a dev container.`},{id:`ci`,label:`A CI runner`,example:`Such as a GitHub Actions job.`}];const AGENTS=[{id:`claude-code`,label:`Claude Code`},{id:`codex`,label:`Codex`},{id:`opencode`,label:`OpenCode`},{id:`hermes`,label:`Hermes Agent`},{id:`openclaw`,label:`OpenClaw`},{id:`custom`,label:`Your own agent`}];const SELECTION_EVENT=`av-setup-selection-change`;const readSelection=()=>{const params=new URLSearchParams(window.location.search);const build=BUILDS.find(option=>option.id===params.get(`building`))??BUILDS[0];const runs=RUNS.find(option=>option.id===params.get(`runs`));const agent=AGENTS.find(option=>option.id===params.get(`agent`));return{building:build.id,runs:runs\u0026\u0026build.runs.includes(runs.id)?runs.id:null,agent:agent?agent.id:null}};const[selection,setSelection]=useState({building:`personal`,runs:null,agent:null});useEffect(()=>{const sync=()=>setSelection(readSelection());sync();window.addEventListener(SELECTION_EVENT,sync);window.addEventListener(`popstate`,sync);return()=>{window.removeEventListener(SELECTION_EVENT,sync);window.removeEventListener(`popstate`,sync)}},[]);const choose=(dimension,value)=>{const toggledOff=dimension!==`building`\u0026\u0026selection[dimension]===value;const next={...selection,[dimension]:toggledOff?null:value};if(dimension===`building`){const build=BUILDS.find(option=>option.id===next.building);if(next.runs\u0026\u0026!build.runs.includes(next.runs))next.runs=null}const params=new URLSearchParams(window.location.search);[`building`,`runs`,`agent`].forEach(key=>{if(next[key])params.set(key,next[key]);else params.delete(key)});const query=params.toString();window.history.replaceState({},``,`${window.location.pathname}${query?`?${query}`:``}${window.location.hash}`);window.dispatchEvent(new Event(SELECTION_EVENT))};const activeBuild=BUILDS.find(option=>option.id===selection.building);const visibleRuns=RUNS.filter(option=>activeBuild.runs.includes(option.id));const renderAgentIcon=id=>{if(id===`custom`){return _jsxs(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,\"aria-hidden\":`true`,children:[_jsx(`path`,{d:`m16 18 6-6-6-6`}),_jsx(`path`,{d:`m8 6-6 6 6 6`})]})}const image=AGENT_IMAGES[id];const src=file=>`${docsBase}${AGENT_IMG_BASE}/${encodeURIComponent(file)}`;const lightFile=image.light??image.dark;const darkFile=image.dark??image.light;if(lightFile===darkFile){return _jsx(`img`,{src:src(lightFile),alt:``,className:`ifx-avqs__img`})}return _jsxs(_Fragment,{children:[_jsx(`img`,{src:src(lightFile),alt:``,className:`ifx-avqs__img ifx-avqs__img--light-only`}),_jsx(`img`,{src:src(darkFile),alt:``,className:`ifx-avqs__img ifx-avqs__img--dark-only`})]})};const renderOption=(dimension,option,children)=>{const active=selection[dimension]===option.id;return _jsx(`button`,{type:`button`,\"aria-pressed\":active,className:active?`ifx-avsp__card ifx-avsp__card--active`:`ifx-avsp__card`,onClick:()=>choose(dimension,option.id),children},option.id)};return _jsxs(`div`,{className:`ifx-avsp__questions not-prose`,children:[_jsxs(`section`,{className:`ifx-avsp__step`,\"data-avsp-focus\":`building`,children:[_jsx(`h2`,{className:`ifx-avsp__step-title`,children:`What are you building?`}),_jsx(`p`,{className:`ifx-avsp__step-desc`,children:`Your answer decides who creates each session and how long each session lasts.`}),_jsx(`div`,{className:`ifx-avsp__cards`,children:BUILDS.map(option=>renderOption(`building`,option,_jsxs(_Fragment,{children:[_jsx(`span`,{className:`ifx-avsp__card-label`,children:option.label}),_jsx(`span`,{className:`ifx-avsp__card-desc`,children:option.example})]})))})]}),_jsxs(`section`,{className:`ifx-avsp__step`,\"data-avsp-focus\":`runs`,children:[_jsx(`h2`,{className:`ifx-avsp__step-title`,children:activeBuild.id===`platform`?`Where do the agents run?`:`Where does the agent run?`}),_jsx(`p`,{className:`ifx-avsp__step-desc`,children:`Your answer decides where to run the proxy and how the agent starts.`}),_jsx(`div`,{className:`ifx-avsp__cards`,children:visibleRuns.map(option=>renderOption(`runs`,option,_jsxs(_Fragment,{children:[_jsx(`span`,{className:`ifx-avsp__card-label`,children:option.label}),_jsx(`span`,{className:`ifx-avsp__card-desc`,children:option.example})]})))})]}),_jsxs(`section`,{className:`ifx-avsp__step`,\"data-avsp-focus\":`agent`,children:[_jsx(`h2`,{className:`ifx-avsp__step-title`,children:`Which agent?`}),_jsx(`p`,{className:`ifx-avsp__step-desc`,children:`Your answer decides which guide to follow and which command starts the agent.`}),_jsx(`div`,{className:`ifx-avsp__cards`,children:AGENTS.map(option=>renderOption(`agent`,option,_jsxs(`span`,{className:`ifx-avsp__card-agent`,children:[_jsx(`span`,{className:`ifx-avsp__card-icon`,children:renderAgentIcon(option.id)}),_jsx(`span`,{className:`ifx-avsp__card-label`,children:option.label})]})))})]})]})};const AgentVaultSetupLayout=({aside,children})=>_jsxs(`div`,{className:`ifx-avsp__layout`,children:[_jsx(`div`,{className:`ifx-avsp__content`,children}),_jsx(`aside`,{className:`ifx-avsp__aside`,children:_jsx(`div`,{className:`ifx-avsp__aside-inner`,children:aside})})]});const AgentVaultSetupPage=({eyebrow,title,description,children})=>{const rootRef=useRef(null);useEffect(()=>{const navbar=document.getElementById(`navbar`);if(rootRef.current\u0026\u0026navbar){rootRef.current.style.setProperty(`--avsp-top`,`${Math.round(navbar.getBoundingClientRect().height)}px`)}},[]);return _jsxs(`div`,{className:`ifx-avsp`,ref:rootRef,children:[_jsxs(`header`,{className:`ifx-avsp__hero`,children:[eyebrow?_jsx(`div`,{className:`ifx-avsp__eyebrow`,children:eyebrow}):null,_jsx(`h1`,{className:`ifx-avsp__title`,children:title}),description?_jsx(`div`,{className:`ifx-avsp__description`,children:description}):null]}),_jsx(`div`,{className:`ifx-avsp__body prose dark:prose-invert`,children})]})};function _createMdxContent(props){const _components={a:`a`,code:`code`,h2:`h2`,p:`p`,strong:`strong`,..._provideComponents(),...props.components},{Note,Warning,_MdxComponentBoundary}=_components;if(!Note)_missingMdxReference(`Note`,true);if(!Warning)_missingMdxReference(`Warning`,true);if(!_MdxComponentBoundary)_missingMdxReference(`_MdxComponentBoundary`,true);return _jsx(_MdxComponentBoundary,{name:`AgentVaultSetupPage`,children:_jsxs(AgentVaultSetupPage,{eyebrow:`Get started`,title:`Plan your Agent Vault setup`,description:`Get a recommended Agent Vault setup for what you're building.`,children:[_jsx(_components.p,{children:`Configure the following options to get custom guidance and best practices tailored to your agent’s setup.`}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupLayout`,children:_jsxs(AgentVaultSetupLayout,{aside:_jsx(AgentVaultSetupDiagram,{}),children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupQuestions`,children:_jsx(AgentVaultSetupQuestions,{})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupDiagram`,children:_jsx(AgentVaultSetupDiagram,{inline:true})})]})}),_jsx(_components.h2,{children:`Your setup`}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupSummary`,children:_jsx(AgentVaultSetupSummary,{})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupLayout`,children:_jsxs(AgentVaultSetupLayout,{aside:_jsx(AgentVaultSetupDiagram,{reveal:true}),children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`before`,children:[_jsx(_components.p,{children:`Before running an agent, you set up two things:`}),_jsxs(`ul`,{children:[_jsxs(`li`,{children:[`An `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/access-bundles`,children:`access bundle`}),` in Infisical: a list of the `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/services`,children:`services`}),` (the external APIs or MCP servers) that the agent can use, each with its real credential`]}),_jsxs(`li`,{children:[`A running `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies`,children:`proxy`}),`: a program on its own machine that every request from the agent goes through`]})]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,children:_jsx(Note,{children:_jsx(_components.p,{children:`One proxy stays running and handles the requests from every agent and every job, so you don’t need a separate proxy for each job or each host.`})})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`create`,children:[_jsxs(_components.p,{children:[`A `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions`,children:`session`}),` gives an agent access to the services in one access bundle, until the session expires or someone `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions#revoke-a-session`,children:`revokes it`}),`.`]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,children:_jsxs(_components.p,{children:[`You `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions#create-a-session`,children:`create the session in the Infisical dashboard`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`assistant`,children:_jsxs(_components.p,{children:[`You `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions#create-a-session`,children:`create one session in the Infisical dashboard`}),` that never expires, since the assistant keeps running.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsxs(_components.p,{children:[`Each time the job runs, the `,_jsx(_components.a,{href:`/cli/overview`,children:`Infisical CLI`}),` logs in as a `,_jsx(_components.a,{href:`/documentation/platform/identities/machine-identities`,children:`machine identity`}),` and creates a session. `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli#choose-how-long-each-session-lasts`,children:`Each session lasts`}),` a little longer than the longest run you expect, because the agent loses access to the APIs if a run outlasts its session.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsxs(_components.p,{children:[`For each task, the orchestrator logs in as a `,_jsx(_components.a,{href:`/documentation/platform/identities/machine-identities`,children:`machine identity`}),` and creates a session through the `,_jsx(_components.a,{href:`/api-reference/endpoints/agent-vault-sessions/create`,children:`Infisical API`}),`. Each kind of task has its own access bundle, and the orchestrator chooses the access bundle when it creates the session.`]})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`token`,children:[_jsx(_components.p,{children:`The session token only works for the services in the session’s access bundle, and only until the session expires or is revoked.`}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,children:_jsx(_components.p,{children:`The dashboard shows the token in a command that starts the agent with it.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`assistant`,children:_jsx(_components.p,{children:`Because the session never expires, revoking it is what stops the assistant from using the real credentials.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsx(_components.p,{children:`The CLI keeps the token and passes it to the agent in the next step, so you never handle the token yourself.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsx(_components.p,{children:`The orchestrator receives the token in the API response.`})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`start`,children:[_jsxs(_components.p,{children:[`The agent gets the session token instead of real API keys. `,_jsx(_components.a,{href:`/cli/reference#agent-vault-run`,children:_jsx(_components.code,{children:`infisical agent-vault run`})}),` starts the agent with its requests set to go through the proxy.`]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,children:_jsx(_components.p,{children:`You run the command from the dashboard on the agent’s host.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsxs(_components.p,{children:[`The CLI starts the agent right after it creates the session. The agent can read the machine identity’s credentials `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli#step-2-start-the-agent`,children:`from its environment`}),`, and could use them to create a session for any access bundle the machine identity has. That’s why the machine identity only has the access bundle that this agent uses.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsx(_components.p,{children:`The orchestrator starts the agent on a different host and passes it only the session token. The orchestrator stays off the agents’ hosts because the machine identity it uses can create sessions for every access bundle it’s granted. An agent that read those credentials could reach every service in those access bundles.`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`claude-code`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so Claude Code runs in its `,_jsx(_components.a,{href:`https://code.claude.com/docs/en/headless`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`claude -p \"\u003cprompt>\"`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`codex`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so Codex runs in its `,_jsx(_components.a,{href:`https://developers.openai.com/codex/noninteractive`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`codex exec \"\u003cprompt>\"`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`opencode`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so OpenCode runs in its `,_jsx(_components.a,{href:`https://opencode.ai/docs/cli/#run-1`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`opencode run \"\u003cprompt>\"`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsxs(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`hermes`,children:[_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so Hermes runs in its `,_jsx(_components.a,{href:`https://hermes-agent.nousresearch.com/docs/user-guide/cli`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`hermes chat -q \"\u003cprompt>\"`}),`.`]}),_jsxs(Note,{children:[` Hermes won’t start without the API keys in `,_jsx(_components.code,{children:`~/.hermes/.env`}),`, so that file holds `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/hermes#step-2-launch-your-agent`,children:`placeholder values`}),`, and the proxy attaches the real keys.`]})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`openclaw`,children:_jsxs(_components.p,{children:[`Nobody is at the terminal while the agent runs, so OpenClaw runs in its `,_jsx(_components.a,{href:`https://docs.openclaw.ai/cli/agent`,children:`non-interactive mode`}),`: `,_jsx(_components.code,{children:`openclaw agent --agent \u003cagent-id> --message \"\u003cprompt>\" --local`}),`. OpenClaw holds a `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/openclaw#step-2-launch-your-agent`,children:`placeholder`}),` instead of your model provider’s key, and the proxy attaches the real key.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{runs:`computer`,children:_jsx(Warning,{children:_jsxs(_components.p,{children:[`The agent runs as your user account. If you’re logged in to the `,_jsx(_components.a,{href:`/cli/overview`,children:`Infisical CLI`}),` on the same computer, the agent can run Infisical CLI commands with your login.`]})})})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`request`,children:[_jsx(_components.p,{children:`The agent calls an API the same way it always does, but the request is intercepted by the proxy.`}),_jsxs(`ul`,{children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{runs:`computer`,children:_jsx(`li`,{children:`If you don’t have a second machine, a small VM on your network can run the proxy`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{runs:`container`,children:_jsx(`li`,{children:`The agents’ containers can’t read the proxy token`})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{runs:`ci`,children:_jsxs(`li`,{children:[`The CI runner has to reach the proxy, so if the proxy is on a private network, the job runs on a `,_jsx(_components.a,{href:`https://docs.github.com/en/actions/hosting-your-own-runners`,children:`self-hosted runner`}),` in that network`]})})})]}),_jsx(Note,{children:_jsxs(_components.p,{children:[`The proxy `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#choose-where-to-run-the-proxy`,children:`runs on a different machine`}),` from the agent, on the same private network. If the proxy ran on the agent’s machine, the agent could read the proxy token.`]})})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsx(AgentVaultSetupStep,{step:`fetch`,children:_jsxs(_components.p,{children:[`The credentials go from Infisical to the proxy, never to the agent. The proxy checks Infisical for updated values every `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#poll-interval`,children:`poll interval`}),` (60 seconds by default).`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`forward`,children:[_jsxs(_components.p,{children:[`The `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/http-apis#credential-types`,children:`real credential`}),` is added to the request at the proxy, so it never passes through the agent. The request appears in the session’s `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/session-logs`,children:`logs`}),`.`]}),_jsxs(_components.p,{children:[`The proxy only attaches credentials for the services in the access bundle. Requests to any other host go out without a credential, unless the proxy’s `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#traffic-policy`,children:`traffic policy`}),` blocks them.`]})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupStep`,children:_jsxs(AgentVaultSetupStep,{step:`revoke`,children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,children:_jsxs(_components.p,{children:[`From then on, the session token stops working. If the machine shuts down before the CLI can revoke the session, the session keeps working until its `,_jsx(_components.code,{children:`--ttl`}),` runs out.`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsxs(_components.p,{children:[`The orchestrator revokes the session through the `,_jsx(_components.a,{href:`/api-reference/endpoints/agent-vault-sessions/revoke`,children:`Infisical API`}),`.`]})})})]})})]})}),_jsx(`div`,{id:`build-your-setup`,className:`ifx-avsp__anchor`}),_jsx(_components.h2,{children:`Build your setup`}),_jsx(_components.p,{children:`Follow these pages in order:`}),_jsxs(`ol`,{children:[_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,agent:`none`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/quickstart`,children:`Quickstart`}),`: create an access bundle with a service for each API the agent calls, then follow the guide for where your agent runs`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,agent:`claude-code,codex,opencode,hermes,openclaw,custom`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/quickstart`,children:`Quickstart`}),`: create an access bundle with a service for each key the agent uses`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,agent:`claude-code`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/claude-code`,children:`Agent Vault with Claude Code`}),`: create a proxy, create a session, and start Claude Code with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,agent:`codex`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/codex`,children:`Agent Vault with Codex`}),`: create a proxy, create a session, and start Codex with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,agent:`opencode`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/opencode`,children:`Agent Vault with OpenCode`}),`: create a proxy, create a session, and start OpenCode with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`hermes`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/hermes`,children:`Agent Vault with Hermes Agent`}),`: create a proxy, create a session, and start Hermes in your terminal with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal`,agent:`openclaw`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/openclaw`,children:`Agent Vault with OpenClaw`}),`: create a proxy, create a session, and start OpenClaw in your terminal with the session token`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`assistant`,agent:`hermes`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/hermes-gateway`,children:`Agent Vault with the Hermes gateway`}),`: add Hermes’s keys to the access bundle, create a session that never expires, then send the Hermes gateway’s requests through the proxy`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`assistant`,agent:`openclaw`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/openclaw-gateway`,children:`Agent Vault with the OpenClaw gateway`}),`: add OpenClaw’s keys to the access bundle, create a session that never expires, then send the OpenClaw gateway’s requests through the proxy`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`personal,assistant`,agent:`custom`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/custom-agent`,children:`Connect your own agent`}),`: create a proxy, create a session, and send your agent’s requests through the proxy`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsxs(AgentVaultSetupBranch,{building:`scheduled,platform`,children:[_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/quickstart`,children:`Quickstart`}),`: create an access bundle with a service for each external system the agent uses`]}),_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#create-a-proxy-and-start-it`,children:`Create a proxy`}),`, and run it with Docker, Kubernetes, or systemd so that it keeps running between jobs`]})]})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,runs:`none,computer,server`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli`,children:`Create sessions with the CLI`}),`: set up a machine identity, then run the agent from cron or systemd`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,runs:`container`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli`,children:`Create sessions with the CLI`}),`: set up a machine identity, then start the agent from the container’s entrypoint`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled`,runs:`ci`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-cli`,children:`Create sessions with the CLI`}),`: set up a machine identity, then start the agent in a GitHub Actions step`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-api`,children:`Create sessions with the API`}),`: set up a machine identity for the orchestrator, then create a session for each task and revoke it when the task ends`]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`platform`,agent:`none,claude-code,codex,opencode,hermes,openclaw`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions-api#step-4-start-the-agent-with-the-session-token`,children:`Start each agent with its session token`}),`: install the Infisical CLI on each agent’s host, and start the agent with `,_jsx(_components.code,{children:`infisical agent-vault run --session-token`})]})})}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`scheduled,platform`,agent:`custom`,children:_jsxs(`li`,{children:[_jsx(_components.a,{href:`/documentation/platform/agent-vault/guides/custom-agent#step-4-send-requests-through-the-proxy`,children:`Send your agent’s requests through the proxy`}),`: set the proxy and the proxy’s certificate in your agent’s HTTP client`]})})})]}),_jsx(_MdxComponentBoundary,{name:`AgentVaultSetupBranch`,children:_jsx(AgentVaultSetupBranch,{building:`assistant`,agent:`none,claude-code,codex,opencode,custom`,children:_jsx(Note,{children:_jsxs(_components.p,{children:[`When the guide has you create a session, set `,_jsx(_components.strong,{children:`Expires`}),` to `,_jsx(_components.strong,{children:`Never`}),`. The assistant keeps running, so a session that expires would cut off its access to the APIs.`]})})})})]})})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{AgentVaultSetupBranch,AgentVaultSetupSummary,AgentVaultSetupStep,AgentVaultSetupDiagram,AgentVaultSetupQuestions,AgentVaultSetupLayout,AgentVaultSetupPage,default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"codeStyling":"dark","config":{},"pageMetadata":{"title":"Plan your Agent Vault setup","sidebarTitle":"Plan your setup","description":"Get a recommended Agent Vault setup for what you're building.","mode":"frame","href":"/documentation/platform/agent-vault/plan-your-setup"}}},"mdxSourceWithNoJs":null,"noJsSplices":[[19,38,""],[157,23247,")=>null;const AgentVaultSetupSummary=()=>null;const AgentVaultSetupStep=()=>null;const AgentVaultSetupDiagram=()=>null;const AgentVaultSetupQuestions=()=>null;const AgentVaultSetupLayout=()=>null;const AgentVaultSetupPage=()=>null;function "]]},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/docs/_mintlify/custom/infisical/b13a5df316344f52/unify.js","/docs/_mintlify/custom/infisical/bc9046d1d11b5448/field-name-copy.js","/docs/_mintlify/custom/infisical/fdfdc80c034be768/cli-reference-nav.js"],"subdomain":"infisical","siteName":"Infisical","title":"Plan your Agent Vault setup - Infisical","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-10-29T15:48:53.972Z","originalFileLocation":"documentation/platform/agent-vault/plan-your-setup.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"light\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Get a recommended Agent Vault setup for what you\u0026#x27;re building.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Infisical\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/x-icon\" sizes=\"180x180\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"icon\" type=\"image/x-icon\" sizes=\"32x32\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"icon\" type=\"image/x-icon\" sizes=\"16x16\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003cmeta data-mint-head property=\"og:title\" content=\"Plan your Agent Vault setup - Infisical\">\u003cmeta data-mint-head property=\"og:description\" content=\"Get a recommended Agent Vault setup for what you\u0026#x27;re building.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Infisical\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://infisical.mintlify.app/_mintlify/api/og/v2?division=Get+started\u0026amp;title=Plan+your+Agent+Vault+setup\u0026amp;description=Get+a+recommended+Agent+Vault+setup+for+what+you%27re+building.\u0026amp;theme=48a50df3ba2e68203e367e83\u0026amp;signature=061adcd83741af2d6a81308e67746201d4faae6139091ea9dd769b510a8ebed6\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Plan your Agent Vault setup - Infisical\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Get a recommended Agent Vault setup for what you\u0026#x27;re building.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://infisical.mintlify.app/_mintlify/api/og/v2?division=Get+started\u0026amp;title=Plan+your+Agent+Vault+setup\u0026amp;description=Get+a+recommended+Agent+Vault+setup+for+what+you%27re+building.\u0026amp;theme=48a50df3ba2e68203e367e83\u0026amp;signature=061adcd83741af2d6a81308e67746201d4faae6139091ea9dd769b510a8ebed6\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/_generated/favicon/browserconfig.xml?v=3\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Infisical\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#26272b\">\u003clink data-mint-head rel=\"canonical\" href=\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/docs/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/documentation/platform/agent-vault/plan-your-setup.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://infisical.com/#organization\",\"name\":\"Infisical\",\"url\":\"https://infisical.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/light.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://infisical.com/docs#website\",\"name\":\"Infisical\",\"url\":\"https://infisical.com/docs\",\"publisher\":{\"@id\":\"https://infisical.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#webpage\",\"url\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\",\"name\":\"Plan your Agent Vault setup\",\"description\":\"Get a recommended Agent Vault setup for what you're building.\",\"dateModified\":\"2026-10-29T15:48:53.972Z\",\"isPartOf\":{\"@id\":\"https://infisical.com/docs#website\"},\"breadcrumb\":{\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Get started\",\"item\":\"https://infisical.com/docs/documentation/platform/agent-vault/quickstart\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Plan your Agent Vault setup\",\"item\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#article\",\"headline\":\"Plan your Agent Vault setup\",\"name\":\"Plan your Agent Vault setup\",\"description\":\"Get a recommended Agent Vault setup for what you're building.\",\"url\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup\",\"mainEntityOfPage\":{\"@id\":\"https://infisical.com/docs/documentation/platform/agent-vault/plan-your-setup#webpage\"},\"dateModified\":\"2026-10-29T15:48:53.972Z\",\"publisher\":{\"@id\":\"https://infisical.com/#organization\"},\"isPartOf\":{\"@id\":\"https://infisical.com/docs#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Infisical\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Infisical","nav":{"global":null,"tabs":[{"tab":"Get started","pages":[{"title":"Get started","href":"/documentation/getting-started/overview"}]},{"tab":"Products","menu":[{"item":"Secrets Management","icon":"key","pages":[{"title":"Secrets Management","href":"/documentation/platform/secrets-mgmt/overview"}]},{"item":"Certificate Management","icon":"file-key","pages":[{"title":"Certificate Management","href":"/documentation/platform/pki/overview"}]},{"item":"Privileged Access Management (PAM)","icon":"users","pages":[{"title":"Privileged Access Management (PAM)","href":"/documentation/platform/pam/overview"}]},{"item":"Agent Vault","icon":"vault","pages":[{"title":"Agent Vault","sidebarTitle":"Agent Vault","icon":"vault","href":"/documentation/platform/agent-vault/overview"},{"group":"Get started","pages":[{"title":"Add your credentials to Agent Vault","sidebarTitle":"Quickstart","href":"/documentation/platform/agent-vault/quickstart"},{"title":"Why use Agent Vault?","href":"/documentation/platform/agent-vault/why-agent-vault"},{"title":"How Agent Vault works","sidebarTitle":"How it works","description":"The concepts Agent Vault uses to broker access to APIs, and how they combine at request time.","href":"/documentation/platform/agent-vault/how-it-works"},{"title":"Plan your Agent Vault setup","sidebarTitle":"Plan your setup","mode":"frame","href":"/documentation/platform/agent-vault/plan-your-setup"}]},{"group":"Guides","pages":[{"group":"Sandboxes","pages":[{"title":"Run agents in Modal sandboxes with Agent Vault","sidebarTitle":"Modal","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/modal.svg","description":"Run an Agent Vault proxy in each Modal sandbox so the agent never has access to a credential.","href":"/documentation/platform/agent-vault/guides/modal"},{"title":"Run agents in Daytona sandboxes with Agent Vault","sidebarTitle":"Daytona","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/daytona.svg","href":"/documentation/platform/agent-vault/guides/daytona"},{"title":"Run agents in Docker containers with Agent Vault","sidebarTitle":"Docker","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/docker.svg","href":"/documentation/platform/agent-vault/guides/docker"}]},{"group":"Messaging gateways","pages":[{"title":"Agent Vault with the Hermes gateway","sidebarTitle":"Hermes gateway","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/hermes.png","href":"/documentation/platform/agent-vault/guides/hermes-gateway"},{"title":"Agent Vault with the OpenClaw gateway","sidebarTitle":"OpenClaw gateway","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/openclaw.svg","href":"/documentation/platform/agent-vault/guides/openclaw-gateway"}]},{"title":"Connect your own agent to Agent Vault","sidebarTitle":"Your own agent","href":"/documentation/platform/agent-vault/guides/custom-agent"},{"group":"Local development","pages":[{"title":"Agent Vault with Claude Code","sidebarTitle":"Claude Code","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/claude-code.svg","href":"/documentation/platform/agent-vault/guides/claude-code"},{"title":"Agent Vault with Codex","sidebarTitle":"Codex","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/OpenAI.png","href":"/documentation/platform/agent-vault/guides/codex"},{"title":"Agent Vault with OpenCode","sidebarTitle":"OpenCode","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/opencode.svg","href":"/documentation/platform/agent-vault/guides/opencode"},{"title":"Agent Vault with Hermes Agent","sidebarTitle":"Hermes Agent","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/hermes.png","href":"/documentation/platform/agent-vault/guides/hermes"},{"title":"Agent Vault with OpenClaw","sidebarTitle":"OpenClaw","icon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/agent-vault-agents/openclaw.svg","href":"/documentation/platform/agent-vault/guides/openclaw"}]}]},{"group":"Concepts","pages":[{"title":"Access bundles","href":"/documentation/platform/agent-vault/access-bundles"},{"group":"Services","root":{"title":"Services","href":"/documentation/platform/agent-vault/services"},"pages":[{"title":"HTTP APIs","href":"/documentation/platform/agent-vault/http-apis"},{"title":"MCP servers","href":"/documentation/platform/agent-vault/mcp-servers"}]},{"title":"Variables","href":"/documentation/platform/agent-vault/variables"},{"title":"Skills","href":"/documentation/platform/agent-vault/skills"},{"group":"Sessions","root":{"title":"Sessions","href":"/documentation/platform/agent-vault/sessions"},"pages":[{"title":"Create Agent Vault sessions with the CLI","sidebarTitle":"Create sessions with the CLI","href":"/documentation/platform/agent-vault/sessions-cli"},{"title":"Create Agent Vault sessions with the API","sidebarTitle":"Create sessions with the API","href":"/documentation/platform/agent-vault/sessions-api"},{"title":"Session logs","sidebarTitle":"Logs","href":"/documentation/platform/agent-vault/session-logs"}]},{"title":"Proxies","href":"/documentation/platform/agent-vault/proxies"},{"title":"Access control","href":"/documentation/platform/agent-vault/access-control"}]}]},{"item":"Key Management Service (KMS)","icon":"lock","pages":[{"title":"Key Management Service (KMS)","href":"/documentation/platform/kms/overview"}]},{"item":"Secret Scanning","icon":"radar","pages":[{"title":"Secret Scanning","href":"/documentation/platform/secret-scanning/overview"}]}]},{"tab":"Platform","menu":[{"item":"Organizations","icon":"building","pages":[{"title":"Organizations","href":"/documentation/platform/organization"}]},{"item":"Identity and access","icon":"id-card","pages":[{"title":"Identity and access","href":"/documentation/platform/identities/overview"}]},{"item":"App connections","icon":"plug","pages":[{"title":"App connections","href":"/integrations/app-connections/overview"}]},{"item":"Networking","icon":"network","pages":[{"title":"Networking","href":"/documentation/platform/gateways/overview"}]},{"item":"Self-hosting","icon":"server","pages":[{"title":"Self-hosting","href":"/self-hosting/overview"}]},{"item":"Internals","icon":"workflow","pages":[{"title":"Internals","href":"/internals/overview"}]},{"item":"Contributing","icon":"git-pull-request","pages":[{"title":"Contributing","href":"/contributing/getting-started/overview"}]}],"pages":[{"title":"Platform","href":"/documentation/platform/organization"}]},{"tab":"Reference","icon":{"name":"code","library":"lucide"},"menu":[{"item":"CLI","icon":"terminal","pages":[{"title":"CLI","href":"/cli/overview"}]},{"item":"API","icon":"book-open","pages":[{"title":"API","href":"/api-reference/overview/introduction"}]},{"item":"SDKs","icon":"boxes","pages":[{"title":"SDKs","href":"/sdks/overview"}]}],"pages":[{"title":"Reference","href":"/cli/overview"}]}]},"title":"Plan your Agent Vault setup - Infisical","buildId":"dpl_DGmhKsAzJdVqypJzon18vViniWRY","deploymentId":"dpl_DGmhKsAzJdVqypJzon18vViniWRY","dynamics":[],"chunks":[]}
