Credential Vault

The Gateway provides an encrypted credential vault that stores per-user credentials (OAuth tokens, API keys, JWTs) and makes them available to agents at runtime.

How It Works

Credential Providers

Admins configure credential providers that define how each credential type works:

POST /api/v1/credential-providers
{
  "name": "Gateway API",
  "serviceType": "gateway_api",
  "authType": "jwt",
  "config": {
    "connectUrl": "/auth/connect?service=gateway_api",
    "jwt": { "headerName": "Authorization", "prefix": "Bearer " }
  }
}

Supported Auth Types

Credential Resolution

Agents declare requiredCredentials in their configuration. The Gateway resolves these before forwarding requests:

• Agent invoke route (/api/v1/agents/:id/invoke): Pre-checks credentials. Returns CREDENTIALS_REQUIRED if missing, or injects X-Credential-* headers if available.
• Credential check route (/api/v1/agents/:id/credentials-check): Lightweight preflight check used before invoke/stream starts.
• Resolve API (/api/v1/credentials/resolve): Internal API for SDK/runtime flows that need explicit credential lookup.

MCP proxy routes do not auto-inject per-user vault credentials as X-Credential-*; they forward identity and provider-auth headers.

Encryption

All credentials are encrypted at rest using AES-256-GCM. The encryption key is configured via the CREDENTIAL_ENCRYPTION_KEY environment variable (a 64-character hex string).