Add your credentials to Agent Vault

This quickstart walks you through the setup shared by every Agent Vault workflow. You’ll create an access bundle, add a service for each key your agent uses, and then continue with the guide for where your agent runs.

Prerequisites

An Infisical organization where you’re an Agent Vault admin
The API keys your agent uses, such as its model provider’s key

Step 1: Add your credentials

Infisical dashboard
API

Create an access bundle

In Agent Vault, an access bundle defines the services your agents can reach. To create an access bundle:

In Infisical, open Agent Vault from the product switcher and go to Access Bundles.

Select Create Access Bundle. Give the access bundle a Name, such as code-review, then select Create Access Bundle.

The Create Access Bundle dialog with code-review entered as the name

Add a service

Next, add a service for each key your agent uses.

What services do I need?

Its model provider’s API key, such as ANTHROPIC_API_KEY, if the agent uses one
Each API it calls, such as GitHub
For a messaging gateway, the platform’s token (see the keys that Hermes or OpenClaw uses)
Each remote MCP server it connects to, such as Linear’s, which you can sign in to with OAuth instead of a key (see add an MCP server)

In the access bundle, select Add Service.

On the Choose a template panel, pick the template for the API, or select Custom HTTP API.

The Choose a template panel with GitHub among the available services

On the Details step, check the hosts the service covers, or enter the API’s host if you selected Custom HTTP API. Select Continue.

On the Credential step, paste the real key, then select Continue.

If the API takes the key somewhere other than a header, such as a bot token in the URL, add a substitution instead. Your agent sends the placeholder you enter in Replace.

On the Review step, select Add Service. Repeat from the first step for each remaining key.

Log in as a machine identity

You call the Infisical API as a machine identity with the Admin role in Agent Vault.

In Agent Vault, go to Access Control > Machine Identities and select Add Machine Identity.

On the Create New tab, enter a Name, choose Admin in Role, then select Create.

On the machine identity’s page, select Universal Auth under Authentication. Copy the Client ID, then select Add Client Secret and copy the client secret.

Use this machine identity only for setup. If your agents’ sessions come from code, the guide for your agents has you create a separate machine identity with access to only one access bundle.Call the login endpoint for Universal Auth with the client ID and client secret:

curl -X POST https://app.infisical.com/api/v1/auth/universal-auth/login \
  -H "Content-Type: application/json" \
  -d '{"clientId": "<client-id>", "clientSecret": "<client-secret>"}'

curl -X POST https://eu.infisical.com/api/v1/auth/universal-auth/login \
  -H "Content-Type: application/json" \
  -d '{"clientId": "<client-id>", "clientSecret": "<client-secret>"}'

curl -X POST <your-instance-url>/api/v1/auth/universal-auth/login \
  -H "Content-Type: application/json" \
  -d '{"clientId": "<client-id>", "clientSecret": "<client-secret>"}'

The response includes an accessToken, which you send with each request in the next steps.

Create an access bundle

In Agent Vault, an access bundle defines the services your agents can reach. Call the endpoint to create an access bundle, replacing <access-token> with the accessToken from the login response. In the body, send a name for the access bundle:

curl -X POST https://app.infisical.com/api/v1/agent-vault/access-bundles \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "code-review"}'

curl -X POST https://eu.infisical.com/api/v1/agent-vault/access-bundles \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "code-review"}'

curl -X POST <your-instance-url>/api/v1/agent-vault/access-bundles \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "code-review"}'

The response includes the access bundle’s id, which you need to add a service.

Add a service

Add a service for each key your agent uses.

What services do I need?

Its model provider’s API key, such as ANTHROPIC_API_KEY, if the agent uses one
Each API it calls, such as GitHub
For a messaging gateway, the platform’s token (see the keys that Hermes or OpenClaw uses)
Each remote MCP server it connects to, such as Linear’s (see add an MCP server)

Call the endpoint to create a service, replacing <access-bundle-id> in the URL with the id from the previous step and <access-token> with the accessToken from the login response.In the body, send the hosts that the credential applies to and the credential itself. For example, to add a GitHub personal access token:

curl -X POST https://app.infisical.com/api/v1/agent-vault/access-bundles/<access-bundle-id>/services \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "http",
    "name": "github",
    "hostPattern": "api.github.com, github.com",
    "credential": {
      "type": "basic",
      "username": "x-access-token",
      "password": "<github-token>"
    }
  }'

curl -X POST https://eu.infisical.com/api/v1/agent-vault/access-bundles/<access-bundle-id>/services \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "http",
    "name": "github",
    "hostPattern": "api.github.com, github.com",
    "credential": {
      "type": "basic",
      "username": "x-access-token",
      "password": "<github-token>"
    }
  }'

curl -X POST <your-instance-url>/api/v1/agent-vault/access-bundles/<access-bundle-id>/services \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "http",
    "name": "github",
    "hostPattern": "api.github.com, github.com",
    "credential": {
      "type": "basic",
      "username": "x-access-token",
      "password": "<github-token>"
    }
  }'

Set credential.type to bearer for an API that takes a token in a header, basic for an API that takes a username and password, or passthrough for a host that the agent can call without a credential.

For a key that goes somewhere other than a header, set credential to {"type": "passthrough"} and send the key as a substitution:

"credential": { "type": "passthrough" },
"substitutions": [
  { "placeholder": "__TELEGRAM_BOT_TOKEN__", "surfaces": ["path"], "value": "<telegram-bot-token>" }
]

Repeat this request for each remaining key.

Step 2: Connect your agents

Pick the guide for where your agents run. Each guide continues from the access bundle you just created.

If you’re not sure which guide fits, plan your setup to get a recommendation.

Sandboxes

Start each agent in its own sandbox, with its own proxy.

Modal sandboxes

Run an Agent Vault proxy in each Modal sandbox so the agent never has access to a credential.

Daytona sandboxes

Run an Agent Vault proxy beside each Daytona sandbox so the agent never has access to a credential.

Docker containers

Run an Agent Vault proxy beside each agent container so the agent never has access to a credential.

Messaging gateways

Keep an assistant running on a server so people can message it from Slack, Telegram, or another platform.

Hermes gateway

OpenClaw gateway

Your own code

Your own agent

Launch your custom agent with Agent Vault so it can call HTTP APIs and MCP servers without having access to their credentials.

Get started

Guides

Concepts

Add your credentials to Agent Vault

Prerequisites

Step 1: Add your credentials

Create an access bundle

Add a service

Log in as a machine identity

Create an access bundle

Add a service

Step 2: Connect your agents

Sandboxes

Modal sandboxes

Daytona sandboxes

Docker containers

Messaging gateways

Hermes gateway

OpenClaw gateway

Your own code

Your own agent

Local development

Claude Code

Codex

OpenCode

Hermes Agent

OpenClaw

​Prerequisites

​Step 1: Add your credentials

​Create an access bundle

​Add a service

​Log in as a machine identity

​Create an access bundle

​Add a service

​Step 2: Connect your agents

​Sandboxes

Modal sandboxes

Daytona sandboxes

Docker containers

​Messaging gateways

Hermes gateway

OpenClaw gateway

​Your own code

Your own agent

​Local development

Claude Code

Codex

OpenCode

Hermes Agent

OpenClaw

Prerequisites

Step 1: Add your credentials

Create an access bundle

Add a service

Log in as a machine identity

Create an access bundle

Add a service

Step 2: Connect your agents

Sandboxes

Messaging gateways

Your own code

Local development