Notes from the team behind Authsome. Integration patterns, agent credential workflows, security tradeoffs, and product updates. Written for builders, not buyers.
How Authsome keeps agent credentials out of your env vars.
Environment variables hand the real key to your agent. Here is how a local credential gateway gives agents access without ever exposing the secret.
Browser-based AI agents and the cookie-jar problem.
Browser agents like ChatGPT agent mode, OpenAI Operator, Browser Use, and Anthropic computer-use inherit every cookie and logged-in session in the browser they drive. Here is the threat model, what isolation works today, and the honest line between what a credential broker can and cannot fix.
OpenAI API key hygiene for AI agents: project keys, restricted keys, and what an agent should actually use.
OpenAI ships four key types and per-endpoint scopes most teams never enable. Here is which one to hand an AI agent, how to scope it correctly, and where the dashboard stops helping.
Supply chain risks for AI agents: malicious MCP servers, poisoned skills, and how to triage.
A field guide to the 2025-26 wave of agent supply chain attacks. Malicious MCP servers, poisoned skills, npm and PyPI compromises, the five injection vectors, and the exact triage checklist if you already shipped one.
Browser-based AI agents and the cookie-jar problem.
Browser agents like ChatGPT agent mode, OpenAI Operator, Browser Use, and Anthropic computer-use inherit every cookie and logged-in session in the browser they drive. Here is the threat model, what isolation works today, and the honest line between what a credential broker can and cannot fix.
OpenAI API key hygiene for AI agents: project keys, restricted keys, and what an agent should actually use.
OpenAI ships four key types and per-endpoint scopes most teams never enable. Here is which one to hand an AI agent, how to scope it correctly, and where the dashboard stops helping.
Supply chain risks for AI agents: malicious MCP servers, poisoned skills, and how to triage.
A field guide to the 2025-26 wave of agent supply chain attacks. Malicious MCP servers, poisoned skills, npm and PyPI compromises, the five injection vectors, and the exact triage checklist if you already shipped one.
Anthropic API direct: keeping the key safe in your agent code.
The Anthropic Python and TypeScript SDKs read ANTHROPIC_API_KEY from the process environment by default, which means every dependency and prompt-injected output can read it too. Here is the broker pattern that keeps sk-ant out of the process, for both SDKs.
Building a DevOps agent: cluster, cloud, PagerDuty, GitHub, without a single long-lived key.
A field report on building a production DevOps incident triage agent across EKS, CloudWatch, PagerDuty, Datadog, GitHub and Slack with zero long-lived credentials on disk.
Anthropic API direct: keeping the key safe in your agent code.
The Anthropic Python and TypeScript SDKs read ANTHROPIC_API_KEY from the process environment by default, which means every dependency and prompt-injected output can read it too. Here is the broker pattern that keeps sk-ant out of the process, for both SDKs.
Building a DevOps agent: cluster, cloud, PagerDuty, GitHub, without a single long-lived key.
A field report on building a production DevOps incident triage agent across EKS, CloudWatch, PagerDuty, Datadog, GitHub and Slack with zero long-lived credentials on disk.
Building a research agent: papers, web, Drive, and inbox without leaking.
A field report on wiring a multi-tool research agent across Brave, arXiv, Google Drive, Gmail, Notion, Linear, and Slack, then taking every credential out of the agent process so a prompt injection has nothing to steal.
Compliance for AI agents: SOC 2, audit trails, and the credential question.
SOC 2, ISO 27001, and the EU AI Act all assume a stable identity used a credential. AI agents break that assumption, and the gap between secrets-manager logs and the agent task that actually triggered the call is the part nobody ships for you.
GitHub token hygiene for AI agents: PATs, fine-grained tokens, GitHub Apps, and OAuth.
GitHub offers four ways to authenticate an AI agent and they are not interchangeable. A ranked deep-dive on scope, lifetime, revocation, and audit attribution, with copy-pasteable examples.
Building a research agent: papers, web, Drive, and inbox without leaking.
A field report on wiring a multi-tool research agent across Brave, arXiv, Google Drive, Gmail, Notion, Linear, and Slack, then taking every credential out of the agent process so a prompt injection has nothing to steal.
Compliance for AI agents: SOC 2, audit trails, and the credential question.
SOC 2, ISO 27001, and the EU AI Act all assume a stable identity used a credential. AI agents break that assumption, and the gap between secrets-manager logs and the agent task that actually triggered the call is the part nobody ships for you.
GitHub token hygiene for AI agents: PATs, fine-grained tokens, GitHub Apps, and OAuth.
GitHub offers four ways to authenticate an AI agent and they are not interchangeable. A ranked deep-dive on scope, lifetime, revocation, and audit attribution, with copy-pasteable examples.
API key management for AI agents: the complete 2026 guide.
A definitive 2026 guide to API key management for AI agents. The full options ladder, honest tradeoffs, a decision framework, and the threat model, with verified config for Cursor, LangChain, Doppler, Vault, and Infisical.
Running AI agents safely in CI/CD: a 2026 hardening guide.
The Comment and Control disclosures in 2025 showed a PR title can be enough to exfiltrate ANTHROPIC_API_KEY and GITHUB_TOKEN from CI-resident AI agents. Here is where the secrets actually live in a GitHub Actions run, the OIDC and egress patterns that shrink the blast radius, and a worked example.
Securing the OpenAI Agents SDK end to end.
API key management for AI agents: the complete 2026 guide.
A definitive 2026 guide to API key management for AI agents. The full options ladder, honest tradeoffs, a decision framework, and the threat model, with verified config for Cursor, LangChain, Doppler, Vault, and Infisical.
Running AI agents safely in CI/CD: a 2026 hardening guide.
The Comment and Control disclosures in 2025 showed a PR title can be enough to exfiltrate ANTHROPIC_API_KEY and GITHUB_TOKEN from CI-resident AI agents. Here is where the secrets actually live in a GitHub Actions run, the OIDC and egress patterns that shrink the blast radius, and a worked example.
I built an outreach agent that touches six SaaS tools and leaks nothing.
A first-person field report on building a multi-tool AI outreach agent across HubSpot, Notion, Hunter, Resend, Slack, and Linear, then keeping every credential out of the agent process with a local broker and a deny-by-default allowlist.
Secrets managers vs credential brokers for AI agents: Doppler, Vault, Infisical, and where each fits.
Doppler, HashiCorp Vault, and Infisical solve storage, rotation, and access control for AI agents, but they still deliver the raw key into the agent process. Here is where each secrets manager stops, where a credential broker starts, and why you want both.
I built an outreach agent that touches six SaaS tools and leaks nothing.
A first-person field report on building a multi-tool AI outreach agent across HubSpot, Notion, Hunter, Resend, Slack, and Linear, then keeping every credential out of the agent process with a local broker and a deny-by-default allowlist.
Secrets managers vs credential brokers for AI agents: Doppler, Vault, Infisical, and where each fits.
Doppler, HashiCorp Vault, and Infisical solve storage, rotation, and access control for AI agents, but they still deliver the raw key into the agent process. Here is where each secrets manager stops, where a credential broker starts, and why you want both.
Safe API access for LangChain and LlamaIndex agents.
LangChain and LlamaIndex agents load API keys from os.environ, where any prompt injection or compromised tool can read them. Two safe patterns to keep real secrets out of the process.
The agent auth wave: auth.md, ID-JAG, AAuth, CIMD, and why OAuth is finally growing up in 2026.
Six months ago, agent authentication was a gap in the OAuth ecosystem. As of May 2026, five separate efforts are converging on a coherent shape. Here is the map, the timeline, and what is still missing.
MCP gateways in 2026, compared: the twelve you should actually know about.
Twelve real MCP gateways in 2026, sorted by deployment model and use case. Self-hosted open source first, then hosted SaaS, then cloud-platform managed. With an honest take on what is and isn't actually a gateway.
MCP server authentication in 2026: seven approaches, ranked by where the credential lives.
From no-auth localhost to CIMD to credential brokers, seven ways MCP servers handle auth in 2026. Real ranking criteria, current spec status, and an honest look at what production servers actually ship.
What is auth.md? WorkOS's open agent registration protocol, explained.
WorkOS just shipped auth.md, a markdown file your service hosts at /auth.md that tells AI agents how to register on behalf of a user. Here is what it actually does, what it builds on, and what it does not solve.
MCP gateways in 2026, compared: the twelve you should actually know about.
Twelve real MCP gateways in 2026, sorted by deployment model and use case. Self-hosted open source first, then hosted SaaS, then cloud-platform managed. With an honest take on what is and isn't actually a gateway.
MCP server authentication in 2026: seven approaches, ranked by where the credential lives.
From no-auth localhost to CIMD to credential brokers, seven ways MCP servers handle auth in 2026. Real ranking criteria, current spec status, and an honest look at what production servers actually ship.
The agent auth wave: auth.md, ID-JAG, AAuth, CIMD, and why OAuth is finally growing up in 2026.
Six months ago, agent authentication was a gap in the OAuth ecosystem. As of May 2026, five separate efforts are converging on a coherent shape. Here is the map, the timeline, and what is still missing.
What is auth.md? WorkOS's open agent registration protocol, explained.
WorkOS just shipped auth.md, a markdown file your service hosts at /auth.md that tells AI agents how to register on behalf of a user. Here is what it actually does, what it builds on, and what it does not solve.
Top agent proxy tools in 2026: what each one does and what to know before picking one.
Eight tools that sit between AI agents and the services they call. Not a comparison post. A walking tour of the category so you know what each is for, what it's good at, and where it'll bite you.
Top agent proxy tools in 2026: what each one does and what to know before picking one.
Eight tools that sit between AI agents and the services they call. Not a comparison post. A walking tour of the category so you know what each is for, what it's good at, and where it'll bite you.
What is MCP? A developer's primer on the Model Context Protocol.
The protocol that connects AI agents to external tools. What MCP actually is, how the architecture works, what to build with it, and the auth questions nobody answers.
What is MCP? A developer's primer on the Model Context Protocol.
The protocol that connects AI agents to external tools. What MCP actually is, how the architecture works, what to build with it, and the auth questions nobody answers.
AI agent security in 2026: the four threat models you actually need to think about.
Prompt injection, credential exfiltration, runaway autonomy, supply chain. What each one looks like in practice, how attacks actually unfold, and which defenses work.
AI agent security in 2026: the four threat models you actually need to think about.
Prompt injection, credential exfiltration, runaway autonomy, supply chain. What each one looks like in practice, how attacks actually unfold, and which defenses work.
Running agents without losing my keys: a month with authsome.
Five weeks with a local-first credential broker. What worked, what bit me, and the things the docs don't tell you up front.
Running agents without losing my keys: a month with authsome.
Five weeks with a local-first credential broker. What worked, what bit me, and the things the docs don't tell you up front.
Agent credential brokers in 2026: Authsome vs Agent Vault vs Clawvisor vs OneCLI.
Four open-source credential brokers built for AI agents. What each one optimizes for, who they're built for, and how to pick.
Agent credential brokers in 2026: Authsome vs Agent Vault vs Clawvisor vs OneCLI.
Four open-source credential brokers built for AI agents. What each one optimizes for, who they're built for, and how to pick.
AWS Secrets Manager isn't built for AI agents.
AWS Secrets Manager is great at what it was designed for: serving long-lived service credentials to AWS workloads. AI agents need something different. Here's why, and what to use instead.
Managing multiple GitHub accounts for AI agents.
Work and personal GitHub identities, both reachable from the same shell, with the right one picked per task. The actual mechanics, not the wishful version.
Headless agent OAuth: the device code flow explained.
How OAuth2 device authorization works, why it's the right pattern for SSH sessions and CI runners, and what the RFC doesn't quite tell you.
Running AI agents in production: what nobody tells you about credentials.
Seven credential failure modes that don't show up until you've shipped. Notes from running agents past the demo stage.
Running AI agents in production: what nobody tells you about credentials.
Seven credential failure modes that don't show up until you've shipped. Notes from running agents past the demo stage.
How prompt injection becomes credential exfiltration.
Six real attacks from 2025-2026, the common thread between them, and why filter-the-input defenses can't fix it.
Stop putting API keys in environment variables.
The tutorial pattern that everyone copies has six known leak vectors. Here's how each one fires in production, and what to do instead.
