How Authsome keeps agent credentials out of your env vars

Why environment variables are the problem

The simplest way to give an AI agent credentials is to mount them as environment variables. It works, but anything in that process can read them: the agent, a rogue dependency, or a prompt-injected payload. There is no record of what was called, and rotating a key means editing every environment template.

How a credential gateway fixes it

A local proxy sits between your agents and the outside world. The agent makes a normal API call with a placeholder, and the gateway injects the real credential only as the request leaves the machine.

• The key never enters the agent process.
• Every request is checked against a policy before any secret is read.
• Each credential use produces a verifiable audit event.

Try it in one command

npx skills add agentrhq/authsome

Point your agent at a task and it authenticates through the gateway. See the quickstart for the full setup.

Authsome is provider-side, not framework-side. It manages credentials for the

services your agents call.