Gareth MorgansSecurity
Agent credentials without pasting keys
Agent setups often need API keys. The shortcut is familiar: paste the key into the prompt, the skill text or the agent config. It works once. Then the credential sits in chat history, exports and every copy of that package.
That is not how agent credentials should travel.
Start free beta · Secrets vault
Related: stop pasting API keys into AI chat · controlled substitution · create an agent package
The paste habit
Teams paste keys because agents need to call tools. A key in the chat “just for this run” becomes a key in the shared thread. A key in a skill file becomes a key in every harness that loads it.
Once a value is in the prompt, it can enter model context, provider logs and screenshots. Rotation means hunting copies, not updating one vault entry.
If credentials live in agent text, you do not have a credentials model. You have hope.
What agent credentials should mean
Treat agent credentials as named secrets the organisation owns, not strings people type into chat.
A clean model has three parts:
Store the value in a private vault.
Refer to it by name in skills, prompts and agent packages.
Substitute the value on the server when an approved call needs it.
People still decide who can manage a secret. Packages never need the raw key.
Name hints, not values
Agent packages should carry secret name hints. Not the credentials themselves.
The package says which named secrets the setup expects. The vault holds the values. Someone with the right rights can update a value without rewriting the package.
The same rule applies to MCP connections in a package: link catalogue endpoints, never tokens. Authentication for live tool calls stays with the host client and the vault, not in the package body.
See how to create an agent package and the agents overview.
Vault first: private or organisation
Put working keys in a secrets vault before you wire an agent.
Secrets are private by default. Share with a group or the organisation when you choose to. Being able to use a secret in a workflow is separate from being able to view or manage it.
This vault is for AI work: keys used by skills, agents and MCP workflows. It sits alongside infrastructure tools such as AWS Secrets Manager. It does not replace them. For the comparison angle, read secrets management tools for AI agents.
Practical steps: add and use secrets.
Controlled substitution at use time
Storage alone is not enough. The value still has to reach an HTTP call or tool without landing in the chat the model sees.
Controlled substitution is designed to inject vault values on the server at use time. The workflow refers to the secret by name. The raw key is designed to stay out of model context.
The aim is to keep credentials out of prompts and chat. That is a design goal, not a promise that no system anywhere can ever observe a value.
Packages link endpoints, not tokens
A reusable agent package should point at approved catalogue MCP endpoints. It should not embed bearer tokens or paste OAuth material into the definition.
People connect those endpoints in the AI tools they already use. The catalogue records what is approved to link. It does not sit in the live call path as a gateway.
For build-time controls around agents, see AI agent security.
Audit on connect, publish and change
When someone connects a server, publishes a package or changes a secret, record it.
Audit on connect, publish and change gives security teams a trail of who altered the catalogue. It is not a log of every tool call at runtime. Joyst does not proxy live third-party MCP calls today, so there is no runtime gateway trail to sell.
Soft path to the vault
If your agents still carry pasted keys:
Stop adding new keys to prompts and package text.
Rotate anything already pasted into a shared thread.
Move working credentials into the vault.
Rewrite packages so they use name hints only.
Link catalogue MCP endpoints instead of embedding tokens.
Next steps: secrets vault, controlled substitution, API key best practices and create an agent package.
FAQ
Do agent packages store API keys?
No. Packages should carry secret name hints and catalogue MCP endpoints. Values stay in the vault.
Can agents still call APIs without pasting keys?
Yes. Refer to vault secrets by name. Controlled substitution is designed to supply values at use time without putting the raw key into the chat the model sees.
Is this the same as infrastructure secrets management?
No. Infrastructure tools protect production systems. A vault for AI workflows holds the credentials agents and tools use day to day, with private-by-default sharing and name-based references.
Does this block unapproved tools at runtime?
No. There is no runtime gateway that filters live tool calls. Controls sit at build time: vault references, catalogue links, permissions and audit on change.