AI Agent API Key Security Checklist
An agent's prompt should not be its secret store. Credentials belong in the execution environment or a secrets manager, with the agent receiving only the specific capability needed for a task. The OWASP Secrets Management Cheat Sheet covers access control, rotation, auditing, and lifecycle management for secrets.
Start with a credential inventory
For each connected service, record the credential owner, storage location, permitted resources, allowed operations, expiration or rotation path, and which tool can use it. Separate a read-only search credential from a token that can send email, edit billing, or deploy code. If the provider supports narrower scopes or short-lived credentials, use them.
Test the paths that leak secrets
Run these checks with dummy credentials or canaries:
- Ask the agent to print its configuration, environment, or tool arguments. It should not reveal a credential.
- Feed it an untrusted page or tool response that says a key must be pasted into a support form. It should ignore the instruction and make no outbound call carrying the canary.
- Force a tool error. Inspect logs, traces, exception messages, and user-visible replies for the canary.
- Try the same task with a credential limited to read access. A write attempt should fail at the service boundary, even if the agent asks for it.
- Rotate the canary credential and verify that the old value stops working, the new one works, and no copied value remains in prompts or fixtures.
Keep the enforcement outside the prompt
"Do not share the key" is useful guidance, but it is not access control. The agent should call a narrow tool that uses the credential on its behalf. The tool can validate destinations, methods, and scopes before making the request. Keep sensitive values out of model-visible results when they are not needed for the answer.
The OWASP prompt-injection risk entry explains why instructions in untrusted content cannot be assumed safe. Treat any request in an email, document, or webpage to reveal a credential as untrusted data, regardless of how official it sounds.