Credentials for agents
This page is for developers and administrators who hand a credential to an AI agent. An agent can be wrong, can be misled by text it reads, and leaves transcripts behind. So it should hold the narrowest credential that does the job, for the shortest time, and never see the credential in its own context.
Contents
- One account per agent
- Which credential
- Where credentials live
- Rotation and revocation
- What never goes into a prompt
One account per agent
Give each agent its own account, in its own user group, with a role made for it. Then:
- its permissions are exactly what you granted, not what a person happens to have;
- every action it takes is recorded under its own name in the audit trail;
- disabling the account stops it at once, everywhere.
Never give an agent the administrator account or a person's account. Details: Roles and least privilege.
Which credential
| Interface | Credential | Narrowing | Read |
|---|---|---|---|
| REST API | Personal API key expk_... | Scopes (read, publish, edit, remove), a lifetime, never beyond the owner's policies | A read-only API key, step by step |
| REST API for many users | OAuth2 token | The user's own policies, oauth/authorize | OAuth and API keys |
| expservices | Personal token expt_... | The token's user's policies, a lifetime | Agents and expservices |
| Exponential Intelligence | The provider key | Lives on the server; editors never see it | Configuring a provider |
Where credentials live
- AI provider keys: in
settings/overrideonly (mode 0640), never in a committed file. Setup > EI: Models warns about a provider key anywhere else. - Keys and tokens an external agent uses: in the agent platform's secret store or an environment variable, never in source code, a URL, a prompt or a shared configuration file.
General rules for secrets in Exponential: Environment, settings and secrets.
Rotation and revocation
| Credential | Revoke | Rotate |
|---|---|---|
| Personal API key | My account > API access, or an administrator in Setup > oAuth admin > API keys | Make the new key before the old one ends, switch, revoke the old |
| expservices token | expsession::tokenRevoke | Create a new token, switch, revoke |
| OAuth2 | Setup > oAuth admin | Tokens expire after TokenTTL; refresh tokens renew them |
| Any of them | Disabling the owner's account ends every key and token at once |
Making, revoking, first use and refusals of API keys are in the audit trail as access.apikey.*; expservices tokens
as access.expservices.token.* (The audit trail for AI).
What never goes into a prompt
- A key, token, password or session cookie, even "just for testing".
- The contents of
settings/override. - Personal data the task does not need.
If a credential reached a model's context or a transcript, treat it as disclosed: revoke it and make a new one (Incident response for AI).
Related pages
- Security for applications
- Personal API keys
- Before connecting an agent
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.